joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
call fcn.10086490
cmp dword [0x10c9b2b4], 0
je 0x10086f52
mov edx, dword [ebp + 8]
push esi
push edi
test edx, edx
jne 0x10086f10
xor esi, esi
cmp dword [0x10c9ca78], esi
jbe 0x10086f01
push ebx
mov bl, byte [ebp + 0xc]
shl bl, 2
xor edi, edi
mov edx, dword [0x10c9ca70]
lea edi, [edi + 0x2c]
inc esi
mov cl, byte [edx + edi - 0x18]
xor cl, bl
and cl, 4
xor byte [edx + edi - 0x18], cl
cmp esi, dword [0x10c9ca78]
jb 0x10086ee1
pop ebx
xor eax, eax
pop edi
pop esi
xor ecx, ecx
mov edx, 0x10c9b2b0
xchg dword [edx], ecx
pop ebp
ret
mov esi, dword [0x10c9ca78]
xor eax, eax
test esi, esi
je 0x10086f30
mov edi, dword [0x10c9ca70]
mov ecx, edi
cmp edx, dword [ecx]
je 0x10086f37
inc eax
add ecx, 0x2c
cmp eax, esi
jb 0x10086f24
mov eax, 4
jmp 0x10086f03
cmp eax, 0xffffffff
je 0x10086f30
mov cl, byte [ebp + 0xc]
imul edx, eax, 0x2c
shl cl, 2
xor cl, byte [edx + edi + 0x14]
and cl, 4
xor byte [edx + edi + 0x14], cl
jmp 0x10086f01
mov eax, 2
jmp 0x10086f05

Function at 0x10086f60
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x10086fb5
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10086fa4
push ebx
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x10086f9d
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10086f9d
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10086f75
pop ebx
push dword [edi]
push 0
push dword [0x10c9b2b4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret

Function at 0x10086fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10c9ca6c]
test eax, eax
je 0x10086fdc
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1008702b
mov eax, dword [eax]
test eax, eax
jne 0x10086fd0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10087039
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x10087005
mov ecx, dword [0x10c9ca6c]
pop edi
mov dword [eax], ecx
pop esi
mov dword [0x10c9ca6c], eax
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
xor eax, eax
ret
Function at 0x100956e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.10003ff0
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x1009573e
add eax, 0x10
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.100a9ef9
int3
Function at 0x10095a70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x10120000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
push esi
push 0
push ebx
call fcn.10008750
movzx eax, bl
add esp, 0x10
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x10c9b300
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10003ff0
mov ecx, dword [0x10c9b304]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x10c9b304]
je 0x10095ca8
lea eax, [ebp + 8]
mov ecx, 0x10c9b300
push eax
call fcn.100956e0
push eax
call fcn.10095750
add esp, 4
test al, al
je 0x10095ca8
lea eax, [ebp + 8]
mov ecx, 0x10c9b300
push eax
call fcn.100956e0
push esi
push str.jit_function_addr__p
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x24], xmm0
call fcn.10005580
lea eax, [esi + 0x20]
mov dword [ebp - 0x14], 0x8b11118b
push eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0xffff25c6
push 0x10
push eax
mov dword [ebp - 0xc], 0x11893fff
mov dword [ebp - 8], 0x11111111
call fcn.100a7750
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x10095ba4
lea eax, [esi + 0x1000]
push eax
lea eax, [esi - 0x1000]
push eax
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.100a7750
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10095ba4
push str.cant_find_emu_baseaddr
call fcn.10005580
add esp, 4
mov eax, dword [edi + 0xc]
and eax, 0xffff0000
push eax
push str.x86_base_addr__p
mov dword [0x10125d24], eax
call fcn.10005580
push 0x178
lea eax, [ebp - 0xa34]
push 0
push eax
call fcn.100c25c0
push 0x444
xorps xmm0, xmm0
mov dword [ebp - 0x8a0], 0
lea eax, [ebp - 0x890]
movq qword [ebp - 0x8b4], xmm0
push 0
push eax
movq qword [ebp - 0x8a8], xmm0
mov dword [ebp - 0x898], 0
call fcn.100c25c0
push 0x400
lea eax, [ebp - 0x43c]
push 0
push eax
call fcn.100c25c0
mov eax, dword [ebp - 0x30]
add esp, 0x2c
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x8b8], eax
or ecx, 0x801020
mov eax, dword [ebp - 0x24]
push dword [ebp - 0x1c]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x20]
sub esp, 0xa00
mov dword [ebp - 0x894], eax
mov edi, esp
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x8bc], ecx
mov ecx, 0x280
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xa3c], esi
lea esi, [ebp - 0xa3c]
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x440], 2
rep movsd dword es:[edi], dword [esi]
call fcn.10005820
add esp, 0xa04
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c159b
mov esp, ebp
pop ebp
ret
Function at 0x100a27c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2c55
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10120000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.100c1228
mov esi, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
add esp, 4
lea edi, [eax + 8]
mov edx, dword [esi]
mov ecx, edx
movups xmmword [edi], xmm0
mov dword [ebp - 0x14], edi
mov dword [edi + 0x10], 0
lea eax, [ecx + 2]
mov dword [edi + 0x14], 0
mov dword [ebp + 0xc], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a2834
sub ecx, dword [ebp + 0xc]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.1001c730
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [esi + 4]
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [esi + 0x14]
movq qword [edi + 0x28], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
cmp dword [edi + 0x14], 7
mov edx, dword [edi + 0x10]
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], edi
jbe 0x100a28a0
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov esi, 0x811c9dc5
add edx, edx
je 0x100a28c4
mov edi, dword [ebp + 0xc]
nop
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100a28b0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push esi
push edi
push eax
call fcn.100a23b0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100a2911
cmp dword [ebp - 0x1c], 0
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov byte [esi + 4], 0
je 0x100a28fc
mov ecx, edi
call fcn.100a2d40
push 0x38
push dword [ebp - 0x1c]
call fcn.100c1258
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x4924924
je 0x100a29a4
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f77e0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f77e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x100a2979
call fcn.100a39e0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push esi
push edi
push eax
call fcn.100a23b0
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x100a297c
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
push esi
call fcn.1001d9f0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100a9ed9
int3
Function at 0x100a61a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x10120000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x664]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a625d
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x100a61e4
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a625d
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + eax*2 - 0x414]
nop
mov ecx, eax
sub eax, 2
cmp word [eax], 0x5c
jne 0x100a6200
push edi
push 0x104
push ecx
call fcn.100cd150
add esp, 0xc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a625d
test bl, bl
je 0x100a624a
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a625d
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c159b
mov esp, ebp
pop ebp
ret

Function at 0x100a67e0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10c9bfa0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10c9bb3c]
cmp eax, dword [ecx + 4]
jg 0x100a6829
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x10c9b688
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x100a6824
add esi, 4
cmp esi, 0x10c9bb38
jne 0x100a6810
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10c9bb3c
call fcn.100c16e8
add esp, 4
cmp dword [0x10c9bb3c], 0xffffffff
jne 0x100a67ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10125cb0
push 0x4b0
push 0x10c9b688
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
push 0x10c9bb3c
mov dword [0x10c9bb38], eax
call fcn.100c1697
add esp, 4
jmp 0x100a67ff

Function at 0x100a6870
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a68b0
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a68b0
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a68b0
mov edx, dword [ebp + 0xc]
cmp dword [eax], edx
je 0x100a68b2
add eax, 4
cmp eax, ecx
jb 0x100a68a5
xor eax, eax
pop ebp
ret
Function at 0x100a68c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a6917
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x100a6917
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
test byte [eax + 0x24], 0x20
jne 0x100a68f9
nop dword [eax]
add eax, 0x28
test byte [eax + 0x24], 0x20
je 0x100a68f0
mov ecx, dword [ebp + 0xc]
add edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
and ecx, 0xfffff000
add ecx, 0x1000
add ecx, edx
mov dword [eax], ecx
xor eax, eax
pop ebp
ret
Function at 0x100a6c50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f3096
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push esi
push edi
mov eax, dword [0x10120000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x1c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
xor edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 4], 1
cmp dword [ebp - 0x68], esi
jbe 0x100a6d36
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x38], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100a6cd9
add esi, dword [ebp - 0x70]
jmp 0x100a6d29
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x50]
lea eax, [ecx + edx]
cmp eax, dword [ebp + 0x18]
jb 0x100a6d27
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 0x14]
jb 0x100a6d27
test eax, 0x100
jne 0x100a6d27
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
cmp edi, dword [ebp - 0x10]
je 0x100a6d0e
mov dword [edi], edx
mov dword [edi + 4], ecx
add edi, 8
mov dword [ebp - 0x30], edi
jmp 0x100a6d24
lea eax, [ebp - 0x28]
push eax
push edi
lea ecx, [ebp - 0x34]
call fcn.1000a5e0
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
add esi, ecx
cmp esi, dword [ebp - 0x68]
jb 0x100a6cb0
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x18], esi
jmp 0x100a6d38
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebp - 0x30]
mov edx, esi
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x100a6dd7
mov ecx, dword [edx]
mov esi, dword [ebp + 0x18]
cmp ecx, esi
mov edx, dword [edx + 4]
cmova esi, ecx
cmp esi, dword [ebp + 0x1c]
jae 0x100a6dc7
lea eax, [edx + ecx]
mov dword [ebp - 0x24], eax
nop word [eax + eax]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push eax
push 0
push esi
call fcn.100a6b50
mov esi, eax
add esp, 0x18
test esi, esi
je 0x100a6dc4
mov eax, dword [edi + 4]
mov ecx, esi
inc esi
mov dword [ebp - 0x20], ecx
cmp eax, dword [edi + 8]
je 0x100a6db0
mov dword [eax], ecx
add dword [edi + 4], 4
jmp 0x100a6dbc
lea ecx, [ebp - 0x20]
push ecx
push eax
mov ecx, edi
call fcn.1000a500
mov eax, dword [ebp - 0x24]
cmp esi, dword [ebp + 0x1c]
jb 0x100a6d80
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
add edx, 8
mov dword [ebp - 0x14], edx
cmp edx, eax
jne 0x100a6d62
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x100a6e07
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x100a6dfd
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a6e1a
push ecx
push esi
call fcn.100c1258
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100cd04f
int3
Function at 0x100a6e20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x100a6ea1
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x100a6ea1
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x100a6ea1
add eax, ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push ecx
push eax
call fcn.100a9640
add esp, 0xc
test eax, eax
je 0x100a6ea1
mov edx, dword [ebp + 8]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100a6e72
sub eax, esi
sar eax, 1
add eax, eax
push eax
mov eax, dword [ebp - 8]
push edx
add eax, 0xfffffffc
push eax
push dword [ebp - 4]
call fcn.100a9690
add esp, 0x10
test eax, eax
setne al
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x100a6f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10120000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [ebx]
jne 0x100a6f9e
mov ecx, dword [ebx + 0x3c]
cmp dword [ecx + ebx], 0x4550
jne 0x100a6f9e
mov eax, dword [ecx + ebx + 0xd8]
mov ecx, dword [ecx + ebx + 0xdc]
add eax, ebx
add ecx, eax
cmp eax, ecx
jae 0x100a6f9e
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x100a6faf
add eax, 4
cmp eax, ecx
jb 0x100a6f93
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x100a6f9e
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
mov ax, word [ebp + 0x14]
mov word [ebp - 0xc], ax
je 0x100a7025
push esi
push edi
mov edi, dword [ebp + 0x10]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x100a7010
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x100a6ff1
cmp dl, 0x11
jne 0x100a700a
inc eax
cmp eax, 6
jl 0x100a6fe0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x100a6fd7
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push ebx
push 6
push eax
call fcn.100a7750
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop ebx
call fcn.100c159b
mov esp, ebp
pop ebp
ret
Function at 0x100a70f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10120000]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a713d
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a713d
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a713d
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x100a714d
add eax, 4
cmp eax, ecx
jb 0x100a7132
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x100a713d
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x100a7161
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100a7167
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x100a71d5
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x100a71c0
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
nop dword [eax]
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x100a71a1
cmp dl, 0x11
jne 0x100a71ba
inc eax
cmp eax, 6
jl 0x100a7190
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x100a7187
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.100a7750
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100c159b
mov esp, ebp
pop ebp
ret

Function at 0x100a7200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
sub esp, 0xc
cmp ax, word [edx]
jne 0x100a7243
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a7243
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a7243
mov edx, dword [ebp + 0xc]
cmp dword [eax], edx
je 0x100a725e
add eax, 4
cmp eax, ecx
jb 0x100a7238
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x100a7243
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x100a7272
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x100a7278
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push dword [ebp + 8]
call fcn.100a6c50
mov eax, dword [ebp + 8]
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100a7830
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100a7780
add esp, 0x18
test eax, eax
je 0x100a7859
inc eax
cmp byte [eax], 0xcc
je 0x100a7853
pop ebp
ret
Function at 0x100a7a60
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.100a79a0
add esp, 0x18
test eax, eax
je 0x100a7a89
inc eax
cmp byte [eax], 0xcc
je 0x100a7a83
pop ebp
ret

Function at 0x100af077
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100af09e
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100af0a1
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100af053
pop esi
leave
ret 8

Function at 0x100b4485
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x100b44a8
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x100b4496
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x100c11e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.100d7d74
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100c1223
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push 2
push ecx
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x100c1223
sub eax, 1
je 0x100c121e
sub eax, 1
je 0x100c121a
xor eax, eax
leave
ret
push 3
jmp 0x100c1225
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x100c1282
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x100c12b7
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x100c12b4
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x100c12c0
add edx, 0x28
cmp edx, esi
jne 0x100c12a2
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100c12bd

Function at 0x100dfe9f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101091ac
push 0x101091a4
push str.FlsAlloc
push 0x1e
call fcn.100dfccc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dfed3
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f739c]
call esi
jmp 0x100dfed9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x100dff1d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101091bc
push 0x101091b4
push str.FlsGetValue
push 0x20
call fcn.100dfccc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100dff54
push dword [ebp + 8]
mov ecx, esi
call dword [0x100f739c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]