joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050fd0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
jmp 0x10051008
mov eax, dword [ebp - 0x114]
add eax, 1
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [ebp - 0x110]
jae 0x1005102f
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp + edx*4 - 0x10c]
cmp eax, dword [0x101071f4]
jne 0x1005102d
jmp 0x1005102f
jmp 0x10050ff9
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [ebp - 0x110]
jne 0x10051067
cmp dword [ebp - 0x110], 0x40
jae 0x10051067
mov edx, dword [ebp - 0x114]
mov eax, dword [0x101071f4]
mov dword [ebp + edx*4 - 0x10c], eax
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
xor edx, edx
jne 0x10050fed
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
jne 0x100510c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.select_failed_with_error:__i_n
call fcn.10026510
add esp, 8
call fcn.10051860
or eax, 0xffffffff
jmp 0x10051157
cmp dword [ebp - 0x118], 0
jle 0x10051155
push 0
push 0x200
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x101071f4]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jle 0x1005112a
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push str.got_bytes__i_n
call fcn.10026510
add esp, 8
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
push edx
push 0x100be8cc
call fcn.10026510
add esp, 8
mov eax, 1
jmp 0x10051157
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x1005114b
push str.Connection_closed_by_the_server._n
call fcn.10026510
add esp, 4
call fcn.10051860
or eax, 0xffffffff
jmp 0x10051157
call fcn.10051860
or eax, 0xffffffff
jmp 0x10051157
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret
Function at 0x10051170
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009fe8d
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [0x101071f4], 0xffffffff
jne 0x100511e1
push str.failed_to_send_message_to_server__not_connected_n
call fcn.10026510
add esp, 4
call fcn.10051860
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000a790
mov eax, dword [ebp - 0x21c]
jmp 0x1005137b
lea ecx, [ebp + 8]
call fcn.10017170
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [ebp - 0x214], eax
movzx eax, byte [ebp + 0x20]
cmp eax, 2
jne 0x1005123a
mov dword [ebp - 0x220], 0x70
mov dword [ebp - 0x224], 1
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.10050700
add esp, 0xc
mov ecx, dword [eax]
mov dword [ebp - 0x214], ecx
mov edx, 1
imul eax, edx, 0
mov cl, byte [ebp + 0x20]
mov byte [ebp + eax - 0x210], cl
mov edx, dword [ebp - 0x214]
add edx, 1
cmp edx, 0x200
jae 0x1005133e
mov eax, dword [ebp - 0x214]
add eax, 1
mov dword [ebp - 0x228], eax
lea ecx, [ebp + 8]
call fcn.10017170
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x22c]
push edx
lea eax, [ebp - 0x20f]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.10017170
push eax
push str.sent:__s_n
call fcn.10026510
add esp, 8
push 0
mov ecx, dword [ebp - 0x214]
add ecx, 1
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x101071f4]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xffffffff
jne 0x10051305
call fcn.10051860
mov dword [ebp - 0x230], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000a790
mov eax, dword [ebp - 0x230]
jmp 0x1005137b
mov ecx, dword [ebp - 0x218]
push ecx
push str.Sent:__d_n
call fcn.10026510
add esp, 8
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x234], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000a790
mov eax, dword [ebp - 0x234]
jmp 0x1005137b
push str.Message_is_too_long_to_send_n
call fcn.10026510
add esp, 4
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1000a790
mov eax, dword [ebp - 0x238]
jmp 0x1005137b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret
Function at 0x10051890
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 8
lea ecx, [ebp - 0xc]
push ecx
push 0x1006
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x100518dd
push str.Failed_to_set_receive_timeout._n
call fcn.10026510
add esp, 4
xor al, al
jmp 0x10051929
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100518fe
mov al, 1
jmp 0x10051929
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x1005191a
push str.Connection_attempt_timed_out._n
call fcn.10026510
add esp, 4
jmp 0x10051927
push str.Failed_to_connect_to_the_server._n
call fcn.10026510
add esp, 4
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret

Function at 0x10057380
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x10325476
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx + 0x10], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx + 0x10], 0
pop ebp
ret
Function at 0x1006b080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x24], ecx
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1006b0ad
mov eax, 0xfffffffd
jmp 0x1006b1ab
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x1006b0cd
mov eax, 0xfffffffd
jmp 0x1006b1ab
cmp dword [ebp - 8], 0
jne 0x1006b0da
xor eax, eax
jmp 0x1006b1ab
mov edx, dword [ebp - 8]
push edx
call fcn.1009bb47
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006b0ff
mov eax, 0xfffffffe
jmp 0x1006b1ab
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
je 0x1006b167
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1009c221
add esp, 4
cmp dword [ebp - 0xc], 0
jne 0x1006b153
mov dword [ebp - 0x20], 0
jmp 0x1006b160
mov dword [ebp - 4], 0x8123
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, 0xfffffffd
jmp 0x1006b1ab
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.1006ae50
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.1009c221
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x1006b19b
mov dword [ebp - 0x28], 0
jmp 0x1006b1a8
mov dword [ebp - 4], 0x8123
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret 4
Function at 0x10071000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a2850
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x90]
push eax
mov ecx, 0x1011cf28
call fcn.10069bf0
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], edx
lea eax, [ebp - 0x78]
push eax
call fcn.10071420
add esp, 4
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x40], edx
push 0x100c304c
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
lea edx, [ebp - 0x60]
push edx
call fcn.1006f7d0
add esp, 0xc
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.10003390
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.1000a790
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.1000a790
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1000a790
lea ecx, [ebp - 0x28]
call fcn.10017170
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.1000a790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret

Function at 0x10071120
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a288d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x28]
call fcn.10008ba0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1007119b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
lea ecx, [ebp - 0x28]
call fcn.10036180
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.10008770
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000a790
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret 4
Function at 0x100711e0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a28e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1011cf28
call fcn.10037b50
push 0x100c3054
lea eax, [ebp - 0x1d0]
push eax
call fcn.10071420
add esp, 4
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1a8]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.10003390
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d0]
call fcn.1000a790
mov dword [ebp - 0x19c], 0
lea ecx, [ebp - 0x198]
push ecx
lea ecx, [ebp - 0x58]
call fcn.10017170
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xffffffff
je 0x100713ec
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x28]
call fcn.10008950
mov byte [ebp - 4], 3
push 0x100c3058
lea eax, [ebp - 0x28]
push eax
call fcn.100444c0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100712d3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000a790
jmp 0x100713c3
push 0x100c305c
lea edx, [ebp - 0x28]
push edx
call fcn.100444c0
add esp, 8
movzx eax, al
test eax, eax
je 0x100712fc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000a790
jmp 0x100713c3
mov ecx, dword [ebp - 0x198]
and ecx, 0x10
jne 0x100713b7
push 0
push 0x100c3060
lea ecx, [ebp - 0x28]
call fcn.1003cd60
cmp eax, 0xffffffff
je 0x100713b7
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x40]
call fcn.100087e0
mov byte [ebp - 4], 4
push 0
lea ecx, [ebp - 0x28]
call fcn.10019270
sub eax, 5
push eax
lea ecx, [ebp - 0x40]
call fcn.1003cea0
lea eax, [ebp - 0x1b4]
push eax
call fcn.10038f80
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp - 0x19c]
add eax, 1
mov dword [ebp - 0x19c], eax
push 0
push 0
mov ecx, dword [ebp - 0x1ac]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1b8], esp
lea eax, [ebp - 0x40]
push eax
call fcn.100087e0
mov ecx, 0x1011cf28
call fcn.100362d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.1000a790
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000a790
lea ecx, [ebp - 0x198]
push ecx
mov edx, dword [ebp - 0x1a0]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10071297
mov eax, dword [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1000a790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret
Function at 0x1007bde0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], 0
cmp dword [0x1010eb84], 0
jne 0x1007bdfe
mov eax, dword [ebp - 0x1c]
jmp 0x1007bf86
mov dword [ebp - 8], 0
jmp 0x1007be10
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x1010eb80]
jae 0x1007be2e
push 1
imul ecx, dword [ebp - 8], 0x14
add ecx, dword [0x1010eb84]
call fcn.1007ba50
jmp 0x1007be07
mov dword [ebp - 0xc], 0
jmp 0x1007be40
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x1010eb80]
jae 0x1007be5f
imul ecx, dword [ebp - 0xc], 0x14
mov edx, dword [0x1010eb84]
mov eax, dword [edx + ecx + 8]
mov byte [eax + 0x30], 1
jmp 0x1007be37
mov dword [ebp - 0x14], 0
jmp 0x1007be71
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 4
jge 0x1007beae
mov dword [ebp - 0x10], 0
jmp 0x1007be89
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x1010eb80]
jae 0x1007beac
imul ecx, dword [ebp - 0x10], 0x14
mov edx, dword [0x1010eb84]
mov ecx, dword [edx + ecx + 8]
add ecx, 0x50
call fcn.10078d90
jmp 0x1007be80
jmp 0x1007be68
mov dword [ebp - 4], 0
jmp 0x1007bec0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x1010eb80]
jae 0x1007bf69
imul edx, dword [ebp - 4], 0x14
mov eax, dword [0x1010eb84]
mov ecx, dword [eax + edx + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
imul edx, dword [ebp - 4], 0x14
mov eax, dword [0x1010eb84]
mov ecx, dword [eax + edx + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1007bf12
imul edx, dword [ebp - 4], 0x14
mov eax, dword [0x1010eb84]
lea ecx, [eax + edx + 1]
call fcn.1007bae0
imul edx, dword [ebp - 4], 0x14
mov eax, dword [0x1010eb84]
mov ecx, dword [eax + edx + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x1007bf37
push 1
mov ecx, dword [ebp - 0x18]
call fcn.1007bc80
mov dword [ebp - 0x20], eax
jmp 0x1007bf3e
mov dword [ebp - 0x20], 0
imul edx, dword [ebp - 4], 0x14
mov eax, dword [0x1010eb84]
mov dword [eax + edx + 4], 0
imul ecx, dword [ebp - 4], 0x14
mov edx, dword [0x1010eb84]
mov eax, dword [edx + ecx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1007beb7
mov ecx, dword [0x1010eb84]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x1010eb84], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1007cd50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a3a80
mov eax, dword fs:[0]
push eax
sub esp, 0x578
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x554], 0x428
mov eax, dword [ebp + 0xc]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x558]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1007cf18
lea eax, [ebp - 0x554]
push eax
mov ecx, dword [ebp - 0x558]
push ecx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x1007cf18
mov byte [ebp - 0x111], 0x20
push 0
lea edx, [ebp - 0x111]
push edx
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x534]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0x12c]
call fcn.10008950
mov dword [ebp - 4], 0
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x12c]
call fcn.1004a380
mov ecx, dword [eax]
mov dword [ebp - 0x55c], ecx
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x568], edx
lea eax, [ebp - 0x57c]
push eax
lea ecx, [ebp - 0x12c]
call fcn.1004b4f0
mov ecx, dword [eax]
mov dword [ebp - 0x560], ecx
mov edx, dword [ebp - 0x560]
mov dword [ebp - 0x56c], edx
lea eax, [ebp - 0x580]
push eax
lea ecx, [ebp - 0x12c]
call fcn.1004a380
mov ecx, dword [eax]
mov dword [ebp - 0x564], ecx
mov edx, dword [ebp - 0x564]
mov dword [ebp - 0x570], edx
mov eax, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
push eax
mov ecx, dword [ebp - 0x568]
push ecx
mov edx, dword [ebp - 0x56c]
push edx
mov eax, dword [ebp - 0x570]
push eax
lea ecx, [ebp - 0x584]
push ecx
call fcn.100472b0
add esp, 0x14
push 0x811c9dc5
lea ecx, [ebp - 0x12c]
call fcn.10017170
push eax
call fcn.1007d0a0
add esp, 8
cmp eax, dword [ebp + 8]
jne 0x1007cf01
mov edx, dword [ebp - 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x574], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.1000a790
mov eax, dword [ebp - 0x574]
jmp 0x1007cf27
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.1000a790
jmp 0x1007cdb1
mov ecx, dword [ebp - 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret
Function at 0x1007cf40
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1007cf61
xor eax, eax
jmp 0x1007d099
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
add ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0x1007cf7f
xor eax, eax
jmp 0x1007d099
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x78]
push edx
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
push eax
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x1007cfdd
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x14]
jae 0x1007d029
movzx ecx, byte [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
push edx
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push 0x811c9dc5
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1007d0a0
add esp, 8
cmp eax, dword [ebp + 0xc]
jne 0x1007d027
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
jmp 0x1007d029
jmp 0x1007cfd4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x14]
jbe 0x1007d038
xor eax, eax
jmp 0x1007d099
movzx ecx, byte [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
movzx edx, byte [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + ecx*4]
push eax
call fcn.1007d2c0
add esp, 0xc
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x1007d0a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1007d0bf
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1007d0ef
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.1007d0a0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1007d2c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x1007d2d4
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x1007d2d9
mov eax, dword [ebp + 8]
jmp 0x1007d340
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x1007d2fc
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x1007d331
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jb 0x1007d326
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 8], edx
jae 0x1007d326
jmp 0x1007d331
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
jmp 0x1007d2f3
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
sub eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
mov esp, ebp
pop ebp
ret