joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10061c90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152943
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0xb0
call fcn.1011fc95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10061d72
lea eax, [edi + 4]
mov dword [ebx], vtable.csys::Command_class__lambda_161a2ab021767a74d98234fd5380b9bd___struct_csys::Arg_struct_csys::String__.0
lea ecx, [ebx + 4]
push eax
call fcn.10009da0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
push eax
call fcn.10009da0
lea esi, [ebx + 0x38]
mov dword [esi + 0x24], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [edi + 0x5c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10061d20
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x60]
lea edi, [ebx + 0x64]
mov esi, dword [ebp - 0x10]
mov ecx, edi
add esi, 0x64
mov byte [ebp - 4], 4
push esi
mov byte [ebx + 0x60], al
mov dword [ebp - 0x18], edi
call fcn.10009da0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 5
lea ecx, [edi + 0x18]
push eax
call fcn.10009da0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
push ecx
lea ecx, [edi + 0x30]
call fcn.10009da0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10061e50
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101529a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x98
call fcn.1011fc95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10061f28
lea eax, [edi + 4]
mov dword [ebx], vtable.csys::Command_class__lambda_20aaa827e5ae1718b693a1631f0231b3___struct_csys::Arg_float__.0
lea ecx, [ebx + 4]
push eax
call fcn.10009da0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
push eax
call fcn.10009da0
lea esi, [ebx + 0x38]
mov dword [esi + 0x24], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [edi + 0x5c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10061ee0
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x60]
lea edi, [ebx + 0x64]
mov esi, dword [ebp - 0x10]
mov ecx, edi
add esi, 0x64
mov byte [ebp - 4], 4
push esi
mov byte [ebx + 0x60], al
mov dword [ebp - 0x18], edi
call fcn.10009da0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
push ecx
lea ecx, [edi + 0x18]
call fcn.10009da0
mov ecx, dword [esi + 0x30]
mov eax, ebx
mov dword [edi + 0x30], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10062000
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152943
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0xb0
call fcn.1011fc95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x100620e2
lea eax, [edi + 4]
mov dword [ebx], vtable.csys::Command_class__lambda_2e52762c2f99291b5138224f45c252f4___struct_csys::Arg_struct_csys::String__.0
lea ecx, [ebx + 4]
push eax
call fcn.10009da0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
push eax
call fcn.10009da0
lea esi, [ebx + 0x38]
mov dword [esi + 0x24], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [edi + 0x5c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10062090
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x60]
lea edi, [ebx + 0x64]
mov esi, dword [ebp - 0x10]
mov ecx, edi
add esi, 0x64
mov byte [ebp - 4], 4
push esi
mov byte [ebx + 0x60], al
mov dword [ebp - 0x18], edi
call fcn.10009da0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 5
lea ecx, [edi + 0x18]
push eax
call fcn.10009da0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
push ecx
lea ecx, [edi + 0x30]
call fcn.10009da0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10062100
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152943
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0xb0
call fcn.1011fc95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x100621e2
lea eax, [edi + 4]
mov dword [ebx], vtable.csys::Command_class__lambda_2f53d6514f4d92819e14986f052bbcce___struct_csys::Arg_struct_csys::String__.0
lea ecx, [ebx + 4]
push eax
call fcn.10009da0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
push eax
call fcn.10009da0
lea esi, [ebx + 0x38]
mov dword [esi + 0x24], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [edi + 0x5c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10062190
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x60]
lea edi, [ebx + 0x64]
mov esi, dword [ebp - 0x10]
mov ecx, edi
add esi, 0x64
mov byte [ebp - 4], 4
push esi
mov byte [ebx + 0x60], al
mov dword [ebp - 0x18], edi
call fcn.10009da0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 5
lea ecx, [edi + 0x18]
push eax
call fcn.10009da0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 6
push ecx
lea ecx, [edi + 0x30]
call fcn.10009da0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100622c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101529a8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x98
call fcn.1011fc95
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10062398
lea eax, [edi + 4]
mov dword [ebx], vtable.csys::Command_class__lambda_5b9fd5a018bf4d341954e9502e4892a1___struct_csys::Arg_int__.0
lea ecx, [ebx + 4]
push eax
call fcn.10009da0
lea eax, [edi + 0x1c]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x1c]
push eax
call fcn.10009da0
lea esi, [ebx + 0x38]
mov dword [esi + 0x24], 0
mov dword [ebp - 0x18], esi
mov ecx, dword [edi + 0x5c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10062350
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [edi + 0x60]
lea edi, [ebx + 0x64]
mov esi, dword [ebp - 0x10]
mov ecx, edi
add esi, 0x64
mov byte [ebp - 4], 4
push esi
mov byte [ebx + 0x60], al
mov dword [ebp - 0x18], edi
call fcn.10009da0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
push ecx
lea ecx, [edi + 0x18]
call fcn.10009da0
mov ecx, dword [esi + 0x30]
mov eax, ebx
mov dword [edi + 0x30], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10066fe0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movsd xmm1, qword [0x101c6218]
xorps xmm3, xmm3
movsd xmm4, qword [0x101c6220]
xorps xmm2, xmm2
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], 2
nop dword [eax]
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1006705d
lea edx, [esi + 8]
mov edi, eax
nop
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10067020
mov eax, dword [esi]
jmp 0x1006713e
cmp eax, 0x4e0
jb 0x1006713e
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
mov esi, 0xe3
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x10067080
mov edi, dword [ebp + 8]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x100670c8
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov ecx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [esi + 0x1384]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub dword [ebp - 4], 1
addsd xmm0, qword [eax*8 + 0x10157540]
subsd xmm0, xmm3
mulsd xmm0, xmm1
mulsd xmm1, xmm4
addsd xmm2, xmm0
jne 0x10067010
pop edi
movsd qword [ebp - 8], xmm2
fld qword [ebp - 8]
pop esi
movsd qword [ebp - 0x10], xmm1
fdiv qword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10067580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152ed4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 5
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
lea eax, [ecx + 8]
push eax
push ecx
lea eax, [ebp + 8]
push eax
call fcn.10067280
add esp, 0xc
mov ecx, dword [eax]
mov dword [eax], 0
mov ebx, dword [esi]
mov dword [esi], ecx
test ebx, ebx
je 0x10067662
mov ecx, dword [ebx + 0x34]
lea edi, [ebx + 0x10]
test ecx, ecx
je 0x10067657
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x38
push ebx
call fcn.1011fcc5
add esp, 8
mov edi, dword [ebp + 8]
test edi, edi
je 0x10067693
mov ecx, dword [edi + 0x34]
lea ebx, [edi + 0x10]
test ecx, ecx
je 0x10067688
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
push 0x38
push edi
call fcn.1011fcc5
add esp, 8
mov ecx, dword [ebp + 0xc]
lea eax, [ecx + 8]
push eax
push ecx
lea eax, [ebp + 8]
push eax
call fcn.10067280
add esp, 0xc
mov ecx, dword [eax]
mov dword [eax], 0
mov edi, dword [esi + 4]
mov dword [esi + 4], ecx
test edi, edi
je 0x100676e3
mov ecx, dword [edi + 0x34]
lea ebx, [edi + 0x10]
test ecx, ecx
je 0x100676d8
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
push 0x38
push edi
call fcn.1011fcc5
add esp, 8
mov edi, dword [ebp + 8]
test edi, edi
je 0x10067714
mov ecx, dword [edi + 0x34]
lea ebx, [edi + 0x10]
test ecx, ecx
je 0x10067709
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
push 0x38
push edi
call fcn.1011fcc5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10069050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1020d838]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
cmp dword [edi + 0x10], 1
jne 0x10069191
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0x10
mov ebx, dword [esi + 0x10]
jb 0x10069081
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100690a1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10069090
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x24]
lea ecx, [ebx + 0x24]
mov dword [ebp - 0x18], edx
mov esi, dword [ebx + 0x28]
cmp eax, esi
je 0x100690c3
cmp dword [eax], edx
je 0x1006918f
add eax, 4
cmp eax, esi
jne 0x100690b4
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 8]
je 0x100690d3
mov dword [eax], edx
add dword [ecx + 4], 4
jmp 0x100690dd
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.10065cf0
cmp dword [edi + 0x14], 0x10
jb 0x100690e5
mov edi, dword [edi]
mov al, byte [edi]
cmp al, 0x31
jne 0x100690ef
xor ecx, ecx
jmp 0x10069124
cmp al, 0x32
jne 0x100690fa
mov ecx, 1
jmp 0x10069124
cmp al, 0x33
jne 0x10069105
mov ecx, 2
jmp 0x10069124
cmp al, 0x65
jne 0x1006910d
xor ecx, ecx
jmp 0x10069124
cmp al, 0x66
jne 0x10069118
mov ecx, 1
jmp 0x10069124
xor ecx, ecx
mov edx, 2
cmp al, 0x67
cmove ecx, edx
mov dl, byte [ebp - 8]
cmp dl, al
jne 0x10069134
movsx eax, byte [ebp - 7]
movsx ecx, dl
sub ecx, eax
mov eax, dword [ebx + 0xc]
lea edx, [ebx + 0xc]
lea ecx, [ecx + ecx*2]
lea edi, [ebx + 0x18]
inc dword [eax + ecx*4 + 4]
cmp edi, edx
je 0x10069168
mov esi, dword [edx]
mov eax, 0x2aaaaaab
mov ecx, dword [edx + 4]
sub ecx, esi
imul ecx
mov ecx, edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.10065ae0
mov esi, dword [ebx + 0x1c]
mov eax, 0x2aaaaaab
mov edi, dword [edi]
mov ecx, esi
push dword [ebp - 0x18]
sub ecx, edi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
push edi
call fcn.10066ba0
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1011fcd3
mov esp, ebp
pop ebp
ret 8
Function at 0x1006d280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153577
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1020d838]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], ecx
lea ecx, [ebp - 0x40]
push eax
call fcn.10009da0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10009da0
push 0x34
mov dword [ebp - 4], 1
call fcn.1011fc95
mov esi, eax
add esp, 4
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x1006d317
mov eax, dword [ebp - 0x44]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x4c], esi
call fcn.10009da0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
lea ecx, [esi + 0x1c]
push eax
call fcn.10009da0
jmp 0x1006d319
xor esi, esi
mov dword [ebp - 0x4c], esi
lea ebx, [edi + 4]
mov byte [ebp - 4], 4
push ebx
push 0
push esi
push 0x1006ca40
push 0
push 0
call fcn.101333ca
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x1006d366
lea ecx, [ebp - 0x44]
call fcn.1006cb50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011fcd3
mov esp, ebp
pop ebp
ret 0xc
push 6
mov dword [ebx], 0
call fcn.1011eba5
int3

Function at 0x1007df50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x101d1da8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x1007df89
mov dword [ebp - 0x14], 1
jmp 0x1007df90
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x1007dfc7
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
jmp 0x1007df6b
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1007dfd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x101d1da8
cmp dword [ebp + 0xc], 0
je 0x1007e09f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x1007e019
mov dword [ebp - 0x18], 1
jmp 0x1007e020
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x1007e09d
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 0x19]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
cmp eax, 0x23
jne 0x1007e07a
cmp dword [ebp + 0xc], 2
jb 0x1007e07a
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1007e07a
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1007e07a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
movzx edx, byte [ebp - 0xd]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x1007dffb
jmp 0x1007e114
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 0x1a]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x1007e114
movzx edx, byte [ebp - 0xe]
cmp edx, 0x23
jne 0x1007e0f5
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1007e0f5
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1007e0f5
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 8
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [ebp - 0xe]
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 4], edx
jmp 0x1007e09f
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1007f480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.101320a4
add esp, 0x10
xor edx, edx
cmp ebp, esp
call fcn.10120bb4
pop ebp
ret
Function at 0x10098da0
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153bbf
mov eax, dword fs:[0]
push eax
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.10099050
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10099050
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.10099050
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.10098ff0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.10098ff0
mov ecx, dword [ebp - 0x10]
add ecx, 0x84
call fcn.100990a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.100988b0
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.100978b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xe8
call fcn.100978b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xf4
call fcn.100978b0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x100
call fcn.10098ae0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
cmp ebp, esp
call fcn.10120bb4
mov esp, ebp
pop ebp
ret
Function at 0x100a8850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10153d30
mov eax, dword fs:[0]
push eax
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x1020d838]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.100978b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100978b0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.100978b0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [ecx + 0xc], xmm0
mov edx, 0x3f
mov eax, dword [ebp - 0x10]
mov word [eax + 0x3a], dx
mov ecx, 0xffff
mov edx, dword [ebp - 0x10]
mov word [edx + 0x3c], cx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x34], 0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov word [ecx + 0x38], ax
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x3e], 0
mov eax, dword [ebp - 0x10]
movss xmm0, dword [0x1015ae04]
movss dword [eax + 0x40], xmm0
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [ecx + 0x48], xmm0
mov edx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [edx + 0x44], xmm0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4c], 0
push 2
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
push ecx
call fcn.10122c30
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
cmp ebp, esp
call fcn.10120bb4
mov esp, ebp
pop ebp
ret