joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101418c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x34
lea eax, [ebp - 0x38]
mov ebx, ecx
push 0
push eax
call fcn.10425c00
mov ecx, dword [0x11d0c5b8]
add esp, 0xc
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x48], 0
mov esi, dword [eax + ecx*4]
cmp byte [esi + 8], 0
jne 0x10141910
call fcn.10450c0b
cmp byte [esi + 8], 0
xorps xmm0, xmm0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0xbe2c]
mov eax, dword [eax + 0x11cc]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c], 0x34
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x38], 0x4e564441
mov dword [ebp - 0x34], 0x10002
mov dword [ebp - 0x30], 0x34
mov dword [ebp - 0x2c], 0x4e564458
mov dword [ebp - 0x28], 0x200001d
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0
jne 0x1014198b
call fcn.10450c0b
mov eax, dword [esi + 0x10]
mov edi, dword [eax + 0xbe2c]
mov edx, dword [edi + 0x10b4]
test edx, edx
je 0x10141a2a
mov eax, dword [edi]
test eax, eax
je 0x10141a2a
mov ecx, dword [eax + 0xbe28]
test ecx, ecx
je 0x10141a2a
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x10141a2a
cmp dword [eax + 0xd45c], 1
jne 0x10141a1f
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov ecx, dword [edi + 0x10b4]
lea eax, [ebp - 0x58]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xbe28]
push dword [eax + 0x14]
call ecx
mov dword [ebp - 0x3c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x44], xmm0
push eax
call esi
mov ecx, dword [ebp - 0x44]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0x40]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
mov eax, dword [ebp - 0x3c]
jmp 0x10141a26
lea eax, [ebp - 0x58]
push eax
push ecx
call edx
test eax, eax
js 0x10141a44
cmp dword [ebp - 0xc], 1
jne 0x10141a44
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
or byte [ebx + 0xd], 1
xor ecx, ebp
pop edi
pop esi
mov byte [ebx + 0xc], 0
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x10146130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push edi
mov al, byte [ecx + 0x18]
cmp al, byte [ecx + 0x19]
jae 0x101462b0
mov ecx, dword [ecx + 0x14]
test cl, 1
jne 0x101462b0
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x20c]
mov dl, byte [eax + 0x58]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x20c]
cmp dl, byte [eax + 0x58]
jne 0x101462b0
push 0xffffffffffffffff
movsx eax, dl
push eax
call fcn.101457b0
shr ecx, 2
and eax, ecx
and eax, 0x7fff
mov dword [ebp + 0xc], eax
je 0x101462b0
push edi
mov ecx, esi
call fcn.10145880
test al, al
je 0x101461a1
mov byte [ebp + 0xb], 1
jmp 0x101461c6
push edi
push edi
lea ecx, [esi + 0x304c]
call fcn.10049d20
test al, al
je 0x101461c2
inc dword [esi + 0x3048]
or byte [esi + 0x1c], 1
mov byte [ebp + 0xb], 1
jmp 0x101461c6
mov byte [ebp + 0xb], 0
push 0x10
push 0x90
call fcn.10434a32
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x101462a8
push 0x90
push 0
push ebx
call fcn.10425c00
add esp, 0xc
cmp byte [ebp + 0xb], 0
je 0x101462a8
mov ecx, dword [0x11d0c5b8]
mov eax, 3
mov word [ebx], ax
mov eax, dword fs:[0x2c]
and dword [ebx], 0xc000ffff
mov dword [ebx + 4], edi
mov ecx, dword [eax + ecx*4]
mov ecx, dword [ecx + 0x10]
call fcn.1001de10
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 0x78]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x20c]
shl ecx, 2
push ebx
mov eax, dword [eax + 0x248]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x14]
and eax, 0xfffe0002
or ecx, eax
mov dword [ebx + 0x14], ecx
lea ecx, [ebx + 0x80]
mov al, byte [esi + 0x18]
inc al
mov byte [ebx + 0x18], al
mov al, byte [esi + 0x19]
mov byte [ebx + 0x19], al
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x28], eax
lea eax, [ebx + 0x78]
mov dword [ebx + 0x74], esi
mov dword [eax], eax
mov dword [ebx + 0x7c], eax
mov eax, dword [edx + 4]
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov dword [edx + 4], ecx
push dword [edi + 0x20c]
call fcn.10147be0
or dword [esi], 0xc0000000
mov al, 1
or dword [ebx], 0xc0000000
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push edi
mov ecx, esi
call fcn.10145930
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x1014c830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
push 0x80
push 0
and byte [esi], 0xf8
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
mov byte [esi + 1], 0
call fcn.10425c00
push 0x100
lea eax, [esi + 0x108]
push 0
push eax
call fcn.10425c00
mov dword [esi + 0x22c], 0
lea eax, [esi + 0x224]
mov dword [esi + 0x230], 0
add esp, 0x18
mov dword [esi + 0x234], 0
mov dword [esi + 0x238], 0
mov dword [esi + 0x23c], 0
mov dword [esi + 0x240], 0
mov dword [esi + 0x244], 0
mov dword [eax], eax
mov dword [esi + 0x228], eax
lea eax, [esi + 0x264]
mov dword [esi + 0x26c], 0
mov dword [esi + 0x270], 0
mov dword [esi + 0x274], 0
mov dword [esi + 0x278], 0
push 0
mov dword [esi + 0x27c], 0
push 0
mov dword [esi + 0x280], 0
mov dword [esi + 0x284], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push 0
mov dword [eax], eax
mov dword [esi + 0x268], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x208], eax
call edi
cmp dword [esi + 0x208], 0
mov dword [esi + 0x248], eax
je 0x1014ca05
test eax, eax
je 0x1014ca05
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x20c]
push eax
call edi
lea eax, [esi + 0x24c]
push eax
call edi
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x1014c988
mov ecx, dword [0x11d0c5b8]
mov eax, dword fs:[0x2c]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x146c]
mov eax, 0x20
cmp ecx, eax
cmovb eax, ecx
xor edi, edi
mov dword [ebp - 4], eax
test eax, eax
je 0x1014ca05
mov eax, 0x108
push ebx
mov ebx, 0x88
mov dword [ebp + 0xc], eax
nop dword [eax]
lea ecx, [eax + esi]
mov dword [eax + esi + 4], edi
lea eax, [esi - 0x80]
mov dword [ecx], esi
add eax, ebx
push eax
push 0x10000
push ecx
push 0x1014cb40
push 0x10000
push 0
call fcn.1043ce9b
add esp, 0x18
mov dword [ebx + esi], eax
test eax, eax
je 0x1014c9f2
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1014c9ef
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
or byte [esi], 1
mov eax, dword [ebp + 0xc]
inc edi
add eax, 8
add ebx, 4
mov dword [ebp + 0xc], eax
cmp edi, dword [ebp - 4]
jb 0x1014c9b0
pop ebx
or byte [esi], 2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10180e70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp - 0x40]
mov ebx, edx
push edi
push 0x5c
mov dword [ebp - 0x64], eax
mov edi, ecx
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.10425c00
mov ecx, dword [ebp - 0x64]
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x60], 0x4e564441
mov eax, dword [ecx]
mov dword [ebp - 0x5c], 0x10002
mov dword [ebp - 0x58], 0x5c
mov dword [ebp - 0x54], 0x4e564458
mov dword [ebp - 0x50], 0x2000042
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
cmp ebx, 0x90960101
jne 0x10180f0e
mov eax, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [0x11d0c5b8]
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x6c], 0
mov esi, dword [eax + ecx*4]
cmp byte [esi + 8], 0
jne 0x10180f39
call fcn.10450c0b
cmp byte [esi + 8], 0
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 0xbe2c]
mov eax, dword [eax + 0x11cc]
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], 0x5c
jne 0x10180f69
call fcn.10450c0b
mov eax, dword [esi + 0x10]
xor ebx, ebx
mov edi, dword [eax + 0xbe2c]
mov edx, dword [edi + 0x10b4]
test edx, edx
je 0x10181000
mov eax, dword [edi]
test eax, eax
je 0x10181000
mov ecx, dword [eax + 0xbe28]
test ecx, ecx
je 0x10181000
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x10181000
cmp dword [eax + 0xd45c], 1
jne 0x10180ff7
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x1428]
push eax
call esi
mov ecx, dword [edi + 0x10b4]
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0xbe28]
push dword [eax + 0x14]
call ecx
mov ebx, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x68]
movlpd qword [ebp - 0x68], xmm0
push eax
call esi
mov ecx, dword [ebp - 0x68]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0x64]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
jmp 0x10181000
lea eax, [ebp - 0x7c]
push eax
push ecx
call edx
mov ebx, eax
mov ecx, dword [ebp - 4]
shr ebx, 0x1f
xor ecx, ebp
xor bl, 1
pop edi
pop esi
mov al, bl
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10190820
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
push edi
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov eax, dword [eax + edx*4 - 4]
test byte [eax + 0x1bc], 1
je 0x1019090e
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [eax + 0x210]
mov eax, dword [eax + 0x18c]
mov eax, dword [eax + 8]
test eax, eax
je 0x10190860
mov eax, dword [eax + 8]
jmp 0x10190862
xor eax, eax
mov edi, dword [ebx + 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov dword [edi + 0x1400], 0
cmp dword [eax + 0xd45c], 1
jne 0x101908dd
lea eax, [edi + 0x1428]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi + 0x10a0]
lea ecx, [ebp - 0x18]
push ecx
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
mov dword [ebp - 4], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
movlpd qword [ebp - 0x10], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [edi + 0x1428]
mov eax, dword [ebp - 0xc]
sbb eax, dword [edi + 0x142c]
add dword [edi + 0x1420], ecx
adc dword [edi + 0x1424], eax
mov eax, dword [ebp - 4]
jmp 0x101908f8
mov eax, dword [edi + 0x10a0]
lea ecx, [ebp - 0x18]
push ecx
push dword [edi + 0x11cc]
call eax
push eax
push ecx
mov ecx, edi
call fcn.101c9e10
mov edx, dword [ebx + 4]
mov ecx, dword [ebx]
mov ecx, dword [ecx + edx*4 - 4]
and byte [ecx + 0x1bc], 0xfe
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1019b910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
cmp dword [0x11d0c744], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
je 0x1019b9fd
cmp dword [esi + 4], 0x58544e43
jne 0x1019b9fd
mov edi, dword fs:[0x2c]
lea edx, [esp + 0x24]
mov ebx, dword [0x11d0c5b8]
mov eax, dword [esi]
mov dword [esp + 0x5c], 0
mov dword [esp + 0xc], 0
mov ecx, dword [edi + ebx*4]
mov dword [ecx + 0x10], eax
mov ecx, esi
mov dword [esi + 8], 0
mov eax, dword [esi + 0x7fcc]
mov dword [esi + 0x7fc8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x7fcc], 0x26
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x24], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [esp + 0x44], xmm0
movq xmm0, qword [eax + 0x30]
lea eax, [esp + 0xc]
push eax
push 0
movq qword [esp + 0x5c], xmm0
call fcn.101eaa60
mov esi, eax
test esi, esi
js 0x1019b9e7
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edi + ebx*4]
mov ecx, dword [ecx + 0x10]
add ecx, 0x8180
call fcn.1013dfa0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + ebx*4]
mov ecx, dword [eax + 0x10]
add ecx, 0x8180
call fcn.1013dfa0
jmp 0x1019ba02
mov esi, 0x80004005
call fcn.1027e6c0
mov dword [esp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
cmp esi, 0x8007000e
je 0x1019ba31
cmp esi, 0x80070057
jne 0x1019ba39
mov dword [esp + 0x20], 2
jmp 0x1019ba39
mov dword [esp + 0x20], 1
push eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.1027e560
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101b8020
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2024
call fcn.10451050
mov eax, dword [0x11ad127c]
xor eax, esp
mov dword [esp + 0x2020], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
push edi
mov dword [esp + 0x24], eax
je 0x101b818a
push 0x2000
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10425c00
add esp, 0xc
lea eax, [esp + 0x28]
push esi
push 0x1046c630
push 0x2000
push eax
call fcn.100da4c0
lea edi, [esp + 0x38]
mov esi, 0x2000
xor ebx, ebx
add esp, 0x10
add edi, eax
sub esi, eax
cmp dword [ebp + 0x10], ebx
jbe 0x101b80b6
cmp esi, 1
jle 0x101b8154
push 0x1046c640
push esi
push edi
call fcn.100da4c0
inc ebx
add esp, 0xc
add edi, eax
sub esi, eax
cmp ebx, dword [ebp + 0x10]
jb 0x101b8094
cmp esi, 1
jle 0x101b8154
mov eax, dword [ebp + 0x14]
lea esi, [ebp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov cl, byte [eax]
test cl, cl
je case.0x101b8113.6
inc dword [esp + 0x10]
cmp cl, 0x25
jne 0x101b8139
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 1
push eax
push esi
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x20]
call fcn.10097990
cmp dword [esp + 0x1c], 0
je 0x101b810e
add esi, 4
cmp eax, 6
ja case.0x101b8113.6
jmp dword [eax*4 + 0x101b81a0]
mov eax, dword [esp + 0x18]
test eax, eax
jle case.0x101b8113.5
lea esi, [esi + eax*4]
jmp case.0x101b8113.5
mov eax, dword [esp + 0x18]
test eax, eax
jle case.0x101b8113.5
lea esi, [esi + eax*8]
jmp case.0x101b8113.5
add esi, 4
jmp case.0x101b8113.5
mov eax, dword [esp + 0x14]
inc dword [esp + 0x14]
mov byte [eax], cl
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
test cl, cl
jne 0x101b80d3
mov eax, dword [esp + 0x14]
mov byte [eax], 0
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101b8160
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
sub ecx, edx
lea eax, [esp + 0x30]
push ecx
push eax
mov eax, dword [esp + 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x202c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x101b811a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2024
call fcn.10451050
mov eax, dword [0x11ad127c]
xor eax, esp
mov dword [esp + 0x2020], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
push edi
mov dword [esp + 0x24], eax
je 0x101b818a
push 0x2000
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10425c00
add esp, 0xc
lea eax, [esp + 0x28]
push esi
push 0x1046c630
push 0x2000
push eax
call fcn.100da4c0
lea edi, [esp + 0x38]
mov esi, 0x2000
xor ebx, ebx
add esp, 0x10
add edi, eax
sub esi, eax
cmp dword [ebp + 0x10], ebx
jbe 0x101b80b6
cmp esi, 1
jle 0x101b8154
push 0x1046c640
push esi
push edi
call fcn.100da4c0
inc ebx
add esp, 0xc
add edi, eax
sub esi, eax
cmp ebx, dword [ebp + 0x10]
jb 0x101b8094
cmp esi, 1
jle 0x101b8154
mov eax, dword [ebp + 0x14]
lea esi, [ebp + 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov cl, byte [eax]
test cl, cl
je case.0x101b8113.6
inc dword [esp + 0x10]
cmp cl, 0x25
jne 0x101b8139
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 1
push eax
push esi
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x20]
call fcn.10097990
cmp dword [esp + 0x1c], 0
je 0x101b810e
add esi, 4
cmp eax, 6
ja case.0x101b8113.6
jmp dword [eax*4 + 0x101b81a0]
mov eax, dword [esp + 0x18]
test eax, eax
jle case.0x101b8113.5
lea esi, [esi + eax*4]
jmp case.0x101b8113.5
mov eax, dword [esp + 0x18]
test eax, eax
jle case.0x101b8113.5
lea esi, [esi + eax*8]
jmp case.0x101b8113.5
add esi, 4
jmp case.0x101b8113.5
mov eax, dword [esp + 0x14]
inc dword [esp + 0x14]
mov byte [eax], cl
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
test cl, cl
jne 0x101b80d3
mov eax, dword [esp + 0x14]
mov byte [eax], 0
lea ecx, [esp + 0x28]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101b8160
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
sub ecx, edx
lea eax, [esp + 0x30]
push ecx
push eax
mov eax, dword [esp + 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x202c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
Function at 0x101bbc30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 4]
test ebx, ebx
jne 0x101bbc4c
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push edi
mov edi, 1
mov eax, dword [eax]
mov edx, eax
mov dword [ebp - 4], eax
movzx eax, dl
xor eax, 0x811c9dc5
shr edx, 8
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul eax, eax, 0x1000193
xor eax, edx
xor edx, edx
imul eax, eax, 0x2f9fa7c3
mov ecx, eax
shr ecx, 7
xor ecx, eax
lea eax, [ecx + ecx*8]
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
add eax, ecx
mov ecx, dword [esi + 0x10]
shl edi, cl
mov dword [ebp + 0xc], eax
test edi, edi
je 0x101bbcea
lea eax, [edx + 1]
imul eax, edx
lea ecx, [edi - 1]
shr eax, 1
add eax, dword [ebp + 0xc]
and eax, ecx
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
mov eax, dword [ecx + 8]
shr eax, 0x1e
cmp eax, 1
jne 0x101bbce1
mov eax, dword [ebp - 4]
cmp dword [ecx], eax
je 0x101bbcf0
jmp 0x101bbce5
test eax, eax
je 0x101bbcea
inc edx
cmp edx, edi
jb 0x101bbcb7
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*4]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x101bbd00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x101bbd21
push dword [edi + 0x14]
call fcn.100173e0
cmp dword [edi + 4], 0
je 0x101bbe2f
mov edx, dword [ebp + 8]
mov edx, dword [edx]
movzx eax, dl
xor eax, 0x811c9dc5
shr edx, 8
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, dl
shr edx, 8
xor eax, ecx
imul eax, eax, 0x1000193
xor eax, edx
imul eax, eax, 0x2f9fa7c3
mov ecx, eax
shr ecx, 7
xor ecx, eax
lea eax, [ecx + ecx*8]
mov ecx, eax
shr ecx, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
add eax, ecx
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x10]
mov ebx, 1
shl ebx, cl
xor esi, esi
test ebx, ebx
je 0x101bbd76
lea ecx, [ebx - 1]
nop dword [eax]
lea edx, [esi + 1]
mov eax, edx
imul eax, esi
shr eax, 1
add eax, dword [ebp - 4]
and eax, ecx
lea ecx, [eax + eax*2]
mov eax, dword [edi + 4]
mov eax, dword [eax + ecx*4 + 8]
shr eax, 0x1e
test eax, eax
je 0x101bbdcd
cmp eax, 1
jne 0x101bbdc2
mov eax, dword [ebp + 8]
mov esi, dword [edi + 4]
mov eax, dword [eax]
cmp eax, dword [esi + ecx*4]
je 0x101bbe2f
mov esi, edx
lea ecx, [ebx - 1]
cmp esi, ebx
jb 0x101bbd90
jmp 0x101bbd76
mov ecx, dword [edi + 0x18]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1122e340]
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
shr ebx, 0x1f
addsd xmm0, qword [ebx*8 + 0x1122e340]
cvtpd2ps xmm1, xmm0
mulss xmm1, dword [edi + 0x20]
comiss xmm2, xmm1
jbe 0x101bbe3a
mov eax, dword [edi + 0x10]
mov ecx, edi
inc eax
push eax
call fcn.100173e0
mov eax, dword [edi + 0x18]
mov edx, 1
mov ecx, dword [edi + 0x10]
inc eax
shl edx, cl
cmp eax, edx
jbe 0x101bbd76
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x1c]
inc eax
add eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1122e340]
cvtpd2ps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x101bbe6d
mov ecx, dword [edi + 0x10]
push ecx
mov ecx, edi
call fcn.100173e0
jmp 0x101bbd76
comiss xmm2, xmm1
jbe 0x101bbe92
mov eax, dword [edi + 0x10]
mov ecx, edi
inc eax
push eax
call fcn.100173e0
mov ecx, dword [edi + 0x10]
mov ebx, 1
mov eax, ebx
shl eax, cl
cmp eax, ebx
jbe 0x101bbe9a
xor esi, esi
jmp 0x101bbe9a
mov ecx, dword [edi + 0x10]
mov ebx, 1
mov edx, dword [ebp - 4]
lea eax, [esi + 1]
imul eax, esi
shl ebx, cl
dec ebx
shr eax, 1
add eax, edx
and edx, 0x3fffffff
and eax, ebx
or edx, 0x40000000
lea ecx, [eax + eax*2]
mov eax, dword [edi + 4]
lea ecx, [eax + ecx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [eax]
mov dword [ecx + 4], eax
inc dword [edi + 0x18]
cmp dword [edi + 8], ecx
jbe 0x101bbede
mov dword [edi + 8], ecx
cmp dword [edi + 0xc], ecx
jae 0x101bbee6
mov dword [edi + 0xc], ecx
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8