joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44283e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8b70]
jne 0x442848
repz ret
jmp fcn.00442f3d

Function at 0x443430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x4b8e70]
jge 0x443446
jmp 0x443663
cmp dword [ebp + 0xc], 0
jge 0x443455
mov dword [ebp - 4], 0
jmp 0x44346d
mov ecx, dword [ebp + 0xc]
and ecx, 0xffffff00
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
and edx, 0xff
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
je 0x4434c9
mov eax, dword [0x4b8e78]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44348d
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4434c9
mov edx, dword [ebp - 4]
and edx, 0x800
je 0x4434b2
mov eax, dword [ebp - 8]
push eax
push str.Usage:__s
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 0xc
jmp 0x4434c9
mov edx, dword [ebp - 8]
push edx
push str._s:
mov eax, dword [0x4a84e0]
push eax
call fcn.0042a700
add esp, 0xc
mov ecx, dword [ebp - 4]
and ecx, 0x800
je 0x4434d9
jmp 0x4435e1
cmp dword [ebp + 0xc], 0
jge 0x44352e
mov dword [ebp - 0xc], 0
jmp 0x4434f1
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4b8e64]
jge 0x443512
push 0x4a8ba4
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 8
jmp 0x4434e8
mov edx, dword [ebp + 0xc]
push edx
push str.debug_d:
mov eax, dword [0x4a84e0]
push eax
call fcn.0042a700
add esp, 0xc
jmp 0x4435e1
cmp dword [ebp + 0xc], 0
je 0x4435e1
cmp dword [ebp + 0xc], 1
jne 0x443563
push str.warning:
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 8
mov edx, dword [0x4b8e6c]
add edx, 1
mov dword [0x4b8e6c], edx
jmp 0x44358d
mov eax, dword [0x4b8e60]
add eax, 1
mov dword [0x4b8e60], eax
cmp dword [ebp + 0xc], 0xff
jne 0x44358d
push str.panic:
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 8
cmp dword [0x4b8e68], 0
je 0x4435e1
cmp dword [0x4b8e74], 0
je 0x4435c7
mov edx, dword [0x4b8e74]
movsx eax, byte [edx]
test eax, eax
je 0x4435c7
mov ecx, dword [0x4b8e74]
push ecx
push 0x4a8bc8
mov edx, dword [0x4a84e0]
push edx
call fcn.0042a700
add esp, 0xc
mov eax, dword [0x4b8e68]
push eax
push str.line__d:
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 4
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x4a84e0]
push ecx
call fcn.00430bb0
add esp, 0xc
mov edx, dword [ebp - 4]
and edx, 0x100
je 0x44363c
call dword [sym.imp.MSVCR90.dll__errno]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCR90.dll_strerror]
add esp, 4
push eax
push 0x4a8bdc
mov ecx, dword [0x4a84e0]
push ecx
call fcn.0042a700
add esp, 0xc
push 0x4a8be0
mov edx, dword [0x4a84e0]
push edx
call fcn.0042a700
add esp, 8
cmp dword [ebp + 0xc], 3
jl 0x443663
mov eax, dword [ebp + 0xc]
sub eax, 2
push eax
call dword [sym.imp.MSVCR90.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x451d40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4a8b70]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x4b8ee0]
mov ecx, dword [eax + 0x64]
cmp dword [ecx + 0x30], 0
je 0x451e7e
mov edx, dword [0x4b8ee0]
cmp dword [edx + 0x2e0], 0
jne 0x451e7e
push 6
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 0
call fcn.0042a8e0
add esp, 0x14
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x451e7e
mov eax, dword [0x4b8ee0]
mov dword [eax + 0x2e0], 1
push 0x40
lea ecx, [ebp - 0x50]
push ecx
mov edx, dword [0x4b8ee0]
push edx
call fcn.00455bf0
add esp, 0xc
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042c6c0
add esp, 0xc
push 0xffffffffffffffff
push 0x4aa68c
mov edx, dword [ebp - 4]
push edx
call fcn.0042c6c0
add esp, 0xc
lea eax, [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00430bb0
add esp, 0xc
mov dword [ebp - 0x54], 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004038f0
add esp, 8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov dword [edx], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x451e2c
mov dword [ebp - 8], 0x4aa694
mov ecx, dword [ebp - 8]
push ecx
push 0x4aa6a4
mov edx, dword [0x4b8ee0]
mov eax, dword [edx + 0x64]
mov ecx, dword [eax + 4]
and ecx, 4
neg ecx
sbb ecx, ecx
neg ecx
add ecx, 2
push ecx
mov edx, dword [0x4b8ee0]
mov eax, dword [edx + 0x64]
push eax
mov ecx, dword [0x4b8ee0]
push ecx
mov edx, dword [0x4b8ee0]
mov eax, dword [edx + 0x64]
mov ecx, dword [eax + 0x30]
call ecx
add esp, 0x14
mov edx, dword [ebp - 4]
push edx
call fcn.0042b260
add esp, 4
jmp 0x451e96
mov eax, dword [0x4b8ee0]
mov ecx, dword [eax + 0x64]
mov edx, dword [ecx + 4]
and edx, 4
je 0x451e96
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0044283e
mov esp, ebp
pop ebp
ret
Function at 0x465040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 1
test eax, eax
je 0x46507e
cmp dword [ebp + 8], 0
je 0x465057
jmp 0x46507e
push 0x4b0684
push 0xf4
push 0x4b0690
push 0x4b069c
push 8
push 0
call sub.libglib_2.0_0.dll_g_log
add esp, 0x18
xor eax, eax
jmp 0x465186
mov ecx, 1
test ecx, ecx
je 0x4650b6
cmp dword [ebp + 0xc], 0
je 0x46508f
jmp 0x4650b6
push str.ptr___NULL
push 0xf5
push 0x4b06d0
push 0x4b06dc
push 8
push 0
call sub.libglib_2.0_0.dll_g_log
add esp, 0x18
xor eax, eax
jmp 0x465186
mov edx, 1
test edx, edx
je 0x4650f0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x4650c9
jmp 0x4650f0
push str.f__fp___NULL
push 0xf6
push 0x4b0714
push 0x4b0720
push 8
push 0
call sub.libglib_2.0_0.dll_g_log
add esp, 0x18
xor eax, eax
jmp 0x465186
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 0x8000
jne 0x465103
xor eax, eax
jmp 0x465186
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x465142
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp + 0x10]
cmp dword [ebp - 0xc], ecx
jae 0x465183
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0xa
jne 0x465181
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x24], 1
jmp 0x465130
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x489530
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.PATH
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x489555
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x489573
mov edx, dword [0x4b8054]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x489573
mov dword [ebp - 4], str._bin:_usr_bin:_usr_local_bin
mov eax, dword [ebp - 4]
mov dword [0x4b8054], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10001190
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
lea eax, [eax + ecx + 0x18]
test edi, edi
je 0x100011dc
jmp 0x100011b0
test ebx, ebx
je 0x100011b9
cmp dword [eax + 0x14], ebx
ja 0x100011dc
mov edx, dword [eax + 0x10]
mov ecx, ebx
sub ecx, dword [eax + 0x14]
cmp edx, ecx
ja 0x100011dc
mov ecx, dword [eax + 0xc]
cmp dword [ebp + 8], ecx
jb 0x100011d4
add ecx, edx
cmp dword [ebp + 8], ecx
jb 0x100011de
inc esi
add eax, 0x28
cmp esi, edi
jb 0x100011b0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10002870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082487
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
mov edx, dword [esi + 0x50]
mov ebx, dword [esi + 0x54]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
push ebx
cmp eax, 0x10
jb 0x100028c4
call fcn.10038f10
jmp 0x100028c9
call fcn.10038f20
mov byte [ebp - 4], 3
mov edx, dword [esi + 0x3c]
mov ebx, dword [esi + 0x40]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
add esp, 4
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x100028f2
call fcn.10038f10
jmp 0x100028f7
call fcn.10038f20
mov byte [ebp - 4], 2
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
add esp, 4
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.10038f20
mov byte [ebp - 4], 1
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.10038f20
mov byte [ebp - 4], 0
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.10038f20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.10038f20
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003a90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083512
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100a23b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.10036460
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], 2
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.10051220
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xc
call fcn.10051220
mov byte [esi + 0x5c], 1
lea edi, [esi + 0x60]
mov dword [ebp - 4], 0xd
push 1
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.10036460
lea eax, [edi + 0x18]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov ecx, 8
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
lea eax, [edi + 0x68]
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
mov byte [ebp - 4], 0xf
mov eax, dword [edi + 0xb4]
push eax
call fcn.1003e950
mov dword [edi], 0x10090a68
add esp, 4
mov dword [esi], 0x10090ca8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069cdb
mov esp, ebp
pop ebp
ret

Function at 0x1000e610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0xffffff54
pop ebp
jmp method.CryptoPP::PKCS8PrivateKey.2.virtual_4
Function at 0x1000fbd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
push edi
test esi, esi
jne 0x1000fc69
mov byte [ebx + 0x29], 1
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push edx
call fcn.100010f0
mov ecx, eax
add esp, 4
mov dword [esp + 0xc], ecx
mov dword [ebx + 0x10], ecx
test ecx, ecx
je 0x1000fc25
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov eax, esi
call fcn.10001240
mov dword [esp + 0x10], eax
mov dword [ebx + 0x14], eax
test eax, eax
jne 0x1000fd55
mov edi, 0x8013141d
cmp byte [ebx + 0x29], 0
jne 0x1000fc59
mov eax, dword [ebx + 8]
test eax, eax
je 0x1000fc3e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x1000fc4f
push eax
call esi
mov ebx, dword [ebx]
cmp ebx, 0xffffffff
je 0x1000fc59
push ebx
call esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebx + 0x28]
xor ecx, ecx
test al, al
sete cl
xor edx, edx
push 0
push 0
push 3
push 0
mov dword [ebx + 4], 0xffffffff
inc ecx
test al, al
setne dl
push ecx
mov dword [ebx + 8], 0
dec edx
and edx, 0x40000000
or edx, 0x80000000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x1000fcca
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1000fcca
mov eax, dword [esp + 0x10]
mov dword [ebx + 0xc], eax
cmp eax, 0xffffffff
jne 0x1000fcf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000fce0
mov eax, 0x80004005
mov edi, eax
jmp 0x1000fc2a
jle 0x1000fcec
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1000fc2a
mov eax, dword [ebx]
xor edx, edx
cmp byte [ebx + 0x28], dl
push 0
sete dl
push 0
push 0
lea edx, [edx + edx + 2]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx + 4], eax
test eax, eax
jne 0x1000fd24
call fcn.1000e410
mov edi, eax
jmp 0x1000fc2a
xor ecx, ecx
cmp byte [ebx + 0x28], cl
push 0
setne cl
push 0
push 0
lea ecx, [ecx + ecx + 2]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 8], eax
test eax, eax
jne 0x1000fbed
call fcn.1000e410
mov edi, eax
jmp 0x1000fc2a
mov ecx, dword [esp + 0xc]
mov edx, esi
mov esi, dword [eax + 0x20]
call fcn.100011f0
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x1c], ecx
mov ecx, ebx
call fcn.1000f5f0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fe00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008161b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x100a23b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x120], ecx
cmp eax, dword [ebx + 8]
je 0x1000fe4d
mov edx, dword [ebx + 8]
mov esi, dword [ecx]
sub eax, edx
push eax
mov eax, dword [esi + 0xc]
push edx
call eax
mov esi, dword [ebx + 0x10]
movzx eax, word [esi + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x1000fe99
xor eax, eax
mov ecx, 0x3e
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x120]
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0xc4], eax
push 0xf8
lea eax, [ebp - 0x11c]
push eax
mov ecx, edi
call edx
jmp 0x1000fee1
mov ecx, 0x20b
cmp ax, cx
jne 0x1000fffd
xor eax, eax
mov ecx, 0x42
lea edi, [ebp - 0x11c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0xc4], eax
push 0x108
lea eax, [ebp - 0x11c]
push eax
call edx
mov edi, dword [ebp - 0x120]
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi]
lea esi, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
mov eax, dword [edx + 0xc]
push esi
mov ecx, edi
call eax
mov ecx, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 0x134], 0
cmp dx, word [ecx + 6]
jae 0x1000fff9
lea ecx, [esi + 0x10]
mov dword [ebp - 0x124], ecx
jmp 0x1000ff36
mov ecx, dword [ebp - 0x124]
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
add eax, dword [ebx + 8]
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], ecx
mov edi, dword [ebx + 0x18]
mov dword [ebp - 0x130], eax
mov eax, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], edx
call fcn.10006180
mov ecx, dword [ebx + 0x24]
mov edi, dword [ebx + 0x20]
push ecx
lea eax, [ebp - 0x130]
call fcn.10006180
add esp, 8
lea esi, [ebp - 0x130]
mov edi, edi
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [ebp - 0x120]
mov edi, dword [ecx]
push eax
push edx
mov edx, dword [edi + 0xc]
call edx
mov esi, dword [esi + 8]
test esi, esi
jne 0x1000ff90
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x1000ffd6
mov ecx, esi
call fcn.1000e430
push esi
call fcn.1006a385
add esp, 4
mov dword [ebp - 0x128], 0
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebp - 0x134]
movzx edx, word [ecx + 6]
add dword [ebp - 0x124], 0x28
inc eax
mov dword [ebp - 0x134], eax
cmp eax, edx
jb 0x1000ff30
mov al, 1
jmp 0x1001000a
push 0x8013141d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10069cdb
mov esp, ebp
pop ebp
ret
Function at 0x100105d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100833c2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100a23b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], esi
call fcn.10036460
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], 2
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.10051220
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xc
call fcn.10051220
mov byte [esi + 0x5c], 1
lea edi, [esi + 0x60]
mov dword [ebp - 4], 0xd
push 1
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.10036460
lea eax, [edi + 0x10]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, 0x10
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
lea eax, [edi + 0x60]
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
mov byte [ebp - 4], 0xf
mov eax, dword [edi + 0xac]
push eax
call fcn.1005dfc0
mov dword [edi], vtable.CryptoPP::SHA1.0
add esp, 4
mov dword [esi], vtable.CryptoPP::PK_MessageAccumulatorImpl_class_CryptoPP::SHA1_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10069cdb
mov esp, ebp
pop ebp
ret
Function at 0x100151e0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push esi
lea esi, [eax + edx]
push edi
mov dword [ebp - 4], esi
cmp edx, 0x10
jl 0x10015289
lea edx, [ecx + 0x24234428]
lea esi, [ecx - 0x7a143589]
mov edi, ecx
add ecx, 0x61c8864f
push ebx
mov ebx, dword [eax]
imul ebx, ebx, 0x7a143589
sub edx, ebx
mov ebx, dword [eax + 4]
imul ebx, ebx, 0x7a143589
sub esi, ebx
mov ebx, dword [eax + 8]
imul ebx, ebx, 0x7a143589
sub edi, ebx
mov ebx, dword [eax + 0xc]
imul ebx, ebx, 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
rol esi, 0xd
imul esi, esi, 0x9e3779b1
sub ecx, ebx
mov ebx, dword [ebp - 4]
rol edi, 0xd
imul edi, edi, 0x9e3779b1
rol ecx, 0xd
add eax, 0x10
imul ecx, ecx, 0x9e3779b1
add ebx, 0xfffffff0
cmp eax, ebx
jbe 0x10015213
rol ecx, 0x12
rol edi, 0xc
add ecx, edi
rol esi, 7
add ecx, esi
mov esi, dword [ebp - 4]
rol edx, 1
add ecx, edx
mov edx, dword [ebp + 0xc]
pop ebx
jmp 0x1001528f
add ecx, 0x165667b1
add ecx, edx
lea edx, [esi - 4]
cmp eax, edx
ja 0x100152ba
jmp 0x100152a0
mov edi, dword [eax]
imul edi, edi, 0x3d4d51c3
sub ecx, edi
rol ecx, 0x11
add eax, 4
imul ecx, ecx, 0x27d4eb2f
cmp eax, edx
jbe 0x100152a0
cmp eax, esi
jae 0x100152d9
mov edi, edi
movzx edx, byte [eax]
imul edx, edx, 0x165667b1
add ecx, edx
rol ecx, 0xb
inc eax
imul ecx, ecx, 0x9e3779b1
cmp eax, esi
jb 0x100152c0
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul eax, eax, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
pop edi
xor eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100182c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081b38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100a23b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov byte [esi + 0x30], 0
mov dword [esi + 0x34], eax
xor ebx, ebx
push 0x18
mov dword [esi + 0x40], ebx
call fcn.1006a405
add esp, 4
cmp eax, ebx
je 0x10018382
mov dword [esi + 0x3c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3c]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x3c]
mov al, 1
mov byte [ecx + 0x14], al
mov edx, dword [esi + 0x3c]
mov byte [edx + 0x15], al
lea edi, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], ebx
mov byte [ebp - 4], al
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
call ebx
lea eax, [esi + 0x18]
push eax
call ebx
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x10018360
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
cmp ecx, edi
setne al
movzx eax, al
push eax
call edx
mov dword [edi + 0x10], 0
mov dword [edi], 0x100915d4
mov dword [edi + 4], esi
mov dword [edi + 0x10], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp + 0xc], ebx
call fcn.10069d83
push 0x1009add0
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], vtable.std::bad_alloc.0
call fcn.1006b4c5
int3