joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101ce6b0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x101ce701
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea ebp, [ecx*8]
mov esi, dword [ebx]
mov eax, dword [edx + ebp]
cmp esi, eax
je 0x101ce72d
mov esi, dword [edx + ebp + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x101ce72d
mov eax, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x101ce76e
cmp esi, dword [edx + ecx*8]
jne 0x101ce720
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
cmp esi, eax
je 0x101ce758
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
add ecx, ebp
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x101ce7a6
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + ebp + 4], edi
jmp 0x101ce7c8
mov edi, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 4]
call fcn.101db9e0
push edi
call fcn.1025720c
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
ret 0xc
cmp eax, esi
jne 0x101ce7ae
mov dword [ecx], edi
jmp 0x101ce7c8
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x101ce7c8
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + ebp + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebp + 4], eax
mov ecx, ebx
call fcn.101e0f10
mov eax, dword [esp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
ret 0xc
Function at 0x101ce830
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edx, ecx
and edx, eax
cmp dword [ebx + 0x18], edx
ja 0x101ce881
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edx, eax
mov edi, dword [ebx + 8]
lea ebp, [edx*8]
mov ecx, dword [ebx]
mov eax, dword [edi + ebp]
cmp eax, ecx
jne 0x101ce898
mov esi, ecx
jmp 0x101ce89e
mov esi, dword [edi + ebp + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x101ce8b5
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x101ce8e2
cmp esi, dword [edi + edx*8]
jne 0x101ce8a8
mov edi, dword [ecx]
mov ecx, ebx
push dword [esp + 0x18]
push dword [edi + 4]
push edi
call fcn.101cc6c0
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x101ce8f3
push str.list_T__too_long
call dword [0x102ab0c0]
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x101ce92a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
add ecx, ebp
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x101ce940
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + ebp + 4], edi
jmp 0x101ce962
cmp eax, esi
jne 0x101ce948
mov dword [ecx], edi
jmp 0x101ce962
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x101ce962
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + ebp + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebp + 4], eax
mov ecx, ebx
call fcn.101e0fd0
mov eax, dword [esp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
ret 0xc
Function at 0x101ce980
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x101ce9d1
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea ebp, [ecx*8]
mov esi, dword [ebx]
mov eax, dword [edx + ebp]
cmp esi, eax
je 0x101ce9fd
mov esi, dword [edx + ebp + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x101ce9fd
mov eax, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x101cea3e
cmp esi, dword [edx + ecx*8]
jne 0x101ce9f0
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
cmp esi, eax
je 0x101cea28
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
add ecx, ebp
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x101cea6e
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + ebp + 4], edi
jmp 0x101cea90
mov edx, dword [esp + 0x1c]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.1025720c
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
ret 0xc
cmp eax, esi
jne 0x101cea76
mov dword [ecx], edi
jmp 0x101cea90
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x101cea90
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + ebp + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebp + 4], eax
mov ecx, ebx
call fcn.101e0fd0
mov eax, dword [esp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
ret 0xc
Function at 0x101ced80
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edx, ecx
and edx, eax
cmp dword [ebx + 0x18], edx
ja 0x101cedd1
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edx, eax
mov edi, dword [ebx + 8]
lea ebp, [edx*8]
mov ecx, dword [ebx]
mov eax, dword [edi + ebp]
cmp eax, ecx
jne 0x101cede8
mov esi, ecx
jmp 0x101cedee
mov esi, dword [edi + ebp + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x101cee05
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x101cee32
cmp esi, dword [edi + edx*8]
jne 0x101cedf8
mov edi, dword [ecx]
mov ecx, ebx
push dword [esp + 0x18]
push dword [edi + 4]
push edi
call fcn.101cca20
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x101cee43
push str.list_T__too_long
call dword [0x102ab0c0]
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x101cee7a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
add ecx, ebp
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x101cee90
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + ebp + 4], edi
jmp 0x101ceeb2
cmp eax, esi
jne 0x101cee98
mov dword [ecx], edi
jmp 0x101ceeb2
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x101ceeb2
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + ebp + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebp + 4], eax
mov ecx, ebx
call fcn.101e0e50
mov eax, dword [esp + 0x14]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
ret 0xc
Function at 0x101da9f0
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1029b683
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x20]
push esi
mov dword [esp + 0x10], edi
call fcn.101da170
lea eax, [esi + 0xc]
mov dword [esp + 0x18], 0
push eax
lea ecx, [edi + 0xc]
call fcn.101d9f00
lea eax, [esi + 0x18]
mov byte [esp + 0x18], 1
push eax
lea ecx, [edi + 0x18]
call fcn.101d9ca0
mov eax, dword [esi + 0x24]
xorps xmm0, xmm0
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
movzx eax, byte [esi + 0x31]
mov byte [edi + 0x31], al
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
movups xmmword [edi + 0x58], xmm0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x101eb970
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
push edi
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x101eb9c1
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebp, [edx + ecx*4]
cmp edi, esi
jne 0x101eb9d9
mov ecx, esi
jmp 0x101eb9de
mov ecx, dword [ebp + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eba21
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x101eb9ed
mov eax, dword [eax]
jmp 0x101eb9d1
mov ebx, dword [ebx]
mov edx, eax
cmp edi, esi
jne 0x101eb9f9
mov ecx, esi
jmp 0x101eb9fe
mov ecx, dword [ebp + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eba0b
cmp ebx, dword [eax + 8]
jne 0x101eba0b
mov eax, dword [eax]
jmp 0x101eb9f1
cmp edx, eax
je 0x101eba21
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x101eb976
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
push edi
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x101eb9c1
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebp, [edx + ecx*4]
cmp edi, esi
jne 0x101eb9d9
mov ecx, esi
jmp 0x101eb9de
mov ecx, dword [ebp + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eba21
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x101eb9ed
mov eax, dword [eax]
jmp 0x101eb9d1
mov ebx, dword [ebx]
mov edx, eax
cmp edi, esi
jne 0x101eb9f9
mov ecx, esi
jmp 0x101eb9fe
mov ecx, dword [ebp + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eba0b
cmp ebx, dword [eax + 8]
jne 0x101eba0b
mov eax, dword [eax]
jmp 0x101eb9f1
cmp edx, eax
je 0x101eba21
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x101eecd0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x101eed20
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x101eed38
mov ecx, esi
jmp 0x101eed3d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eed6d
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x101eed4c
mov eax, dword [eax]
jmp 0x101eed30
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
jne 0x101eed5f
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x101eee30
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x101eee80
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x101eee98
mov ecx, esi
jmp 0x101eee9d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eeecd
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x101eeeac
mov eax, dword [eax]
jmp 0x101eee90
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
jne 0x101eeebf
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x101eeee0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x101eef30
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x101eef48
mov ecx, esi
jmp 0x101eef4d
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x101eef7d
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x101eef5c
mov eax, dword [eax]
jmp 0x101eef40
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
jne 0x101eef6f
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x101f7c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x38], 0
jne 0x101f7c9e
cmp byte [esi + 0x148], 0
sete al
cmp byte [esi + 0x149], 0
mov byte [esi + 0x148], al
je 0x101f7c8f
mov ecx, dword [esi + 0x170]
push 0
mov byte [esi + 0x149], 0
call dword [0x102accd4]
mov ecx, esi
pop esi
jmp fcn.101ed5a0
call dword [0x102aca50]
mov ecx, eax
pop esi
jmp dword [0x102acd64]
pop esi
ret
Function at 0x10229430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x102a3e79
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x38]
sub eax, dword [esi + 0x34]
test eax, 0xffffffc0
jne 0x102295d7
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x88]
sar eax, 6
cmp eax, ecx
jae 0x102294af
cmp ecx, 0x3ffffff
jbe 0x102294a6
push str.vector_T__too_long
call dword [0x102ab0c0]
push ecx
lea ecx, [esi + 0x34]
call fcn.1022a6d0
cmp dword [esi + 0x8c], 0
xorps xmm0, xmm0
movlpd qword [esp + 0x14], xmm0
jb 0x102295d7
ja 0x102294d4
cmp dword [esi + 0x88], 0
jbe 0x102295d7
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
lea esp, [esp]
mov ecx, dword [esi + 0x10]
mov eax, 0xe6c2b449
sub ecx, dword [esi + 0xc]
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
jbe 0x102295ea
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
sub eax, edx
imul ecx, edi, 0x470
add ecx, dword [esi + 0xc]
cmp eax, edi
jbe 0x102295ea
lea eax, [edx + edi]
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x20]
sub eax, edx
mov dword [esp + 0x14], edx
sar eax, 2
cmp eax, edi
jbe 0x102295ea
mov eax, dword [esp + 0x1c]
push 0
push dword [ecx + 0x20]
lea ecx, [esi + 0x18]
movzx eax, byte [eax]
push 0
push eax
call dword [0x102aba24]
mov ecx, dword [esp + 0x24]
add eax, dword [ecx + edi*4]
mov ecx, dword [esp + 0x30]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.1006d230
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 0x38]
mov dword [esp + 0x70], 0
cmp ecx, dword [esi + 0x3c]
jne 0x10229588
push 1
lea ecx, [esi + 0x34]
call fcn.1022a960
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x70], 1
test ecx, ecx
je 0x102295a2
push eax
call fcn.100565e0
add dword [esi + 0x38], 0x40
lea ecx, [esp + 0x24]
mov dword [esp + 0x70], 0xffffffff
call fcn.1000c730
add edi, 1
adc ebp, 0
cmp ebp, dword [esi + 0x8c]
jb 0x102294e0
ja 0x102295d7
cmp edi, dword [esi + 0x88]
jb 0x102294e0
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
sub eax, edx
mov ecx, dword [esp + 0x78]
sar eax, 6
cmp eax, ecx
ja 0x102295f5
push str.invalid_vector_T__subscript
call dword [0x102ab0bc]
shl ecx, 6
lea eax, [edx + ecx]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.10257318
add esp, 0x60
ret 0xc
Function at 0x1023d220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102a5b42
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x103fb8f8]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x103fb8f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x20], 1
mov dword [esp + 8], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0x4a
push 0x103fb1d8
push ecx
mov dword [esp + 0x14], 0
call dword [0x102ab234]
add esp, 0x10
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call dword [0x102aba64]
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0xffffffff
call dword [0x102aba64]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10257318
add esp, 0x20
ret 0xc
Function at 0x401040
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 2
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401060
xor eax, eax
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
ret

Function at 0x401090
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x50c
push ebp
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
lea edx, [esp + 0x118]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x51c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x520]
push eax
push ecx
push str._s_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x534]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x118]
push eax
push 0xf003f
push 0
push ecx
push edx
call ebp
test eax, eax
je 0x40110e
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x50c
ret
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push 0
push 0
stosb byte es:[edi], al
push 0
lea eax, [esp + 0x1c]
push 0
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x4011c7
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0xf003f
lea ecx, [esp + 0x20]
push 0
push ecx
push edx
call ebp
test eax, eax
jne 0x401198
mov eax, dword [esp + 0x524]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x11c]
push ecx
push edx
call fcn.00401090
add esp, 0xc
test eax, eax
je 0x4011e1
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x18]
push eax
rep stosd dword es:[edi], eax
push eax
push eax
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
push eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], 0x100
push eax
call esi
test eax, eax
je 0x401150
mov edx, dword [esp + 0x524]
lea ecx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x4011ed
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x50c
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x50c
ret