joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10069720
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5192
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
push eax
push 0
push 0x400
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10069813
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x1006980c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1009edd0
mov ebx, eax
add esp, 8
cmp esi, ebx
je 0x100697f5
cmp dword [esi + 0x14], 0x10
jb 0x100697dc
push dword [esi]
call fcn.100dd8b4
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push ebx
mov byte [esi], 0
call fcn.10008120
cmp dword [ebp - 0x21c], 0x10
jb 0x1006980c
push dword [ebp - 0x230]
call fcn.100dd8b4
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x1006a130
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x1006a183
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 4], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x1006a1bd
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1006a1bd
mov eax, dword [edi]
jmp 0x1006a1b0
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1006a200
cmp esi, dword [edx + ecx*8]
jne 0x1006a1b0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x1006a1e7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1006a21c
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x1006a23e
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.100694a0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x1006a224
mov dword [ecx], edi
jmp 0x1006a23e
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1006a23e
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.1006c4a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006a4b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edx, ecx
and edx, eax
cmp dword [ebx + 0x18], edx
ja 0x1006a503
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edx, eax
mov edi, dword [ebx + 8]
lea eax, [edx*8]
mov ecx, dword [ebx]
mov dword [ebp - 4], eax
lea esi, [edi + eax]
mov eax, dword [esi]
cmp eax, ecx
jne 0x1006a51f
mov esi, ecx
jmp 0x1006a524
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1006a53d
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1006a569
cmp esi, dword [edi + edx*8]
jne 0x1006a530
mov edi, dword [ecx]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [edi + 4]
push edi
call fcn.1006a050
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x1006a57b
push str.list_T__too_long
call dword [0x100ef2ac]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x1006a5b2
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1006a5cb
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x1006a5ed
cmp eax, esi
jne 0x1006a5d3
mov dword [ecx], edi
jmp 0x1006a5ed
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1006a5ed
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.1006c4a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006c960
Capabilities:
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x1006c973
jmp dword [eax*4 + 0x1006c9b0]
push ecx
call fcn.1006c9c0
add esp, 4
pop ebp
ret
push ecx
call fcn.1006ccd0
add esp, 4
pop ebp
ret
mov dword [ebp + 0xc], 0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.1006cb20
push ecx
call fcn.1006caa0
add esp, 4
pop ebp
ret
xor al, al
pop ebp
ret

Function at 0x1006cb20
Capabilities:
Get os information via kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101ba32c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 4
test eax, eax
jne 0x1006cb77
push eax
push eax
push eax
push eax
push eax
push 1
push 0x101ba32c
push str._LdrpVectorHandlerList
call fcn.100b8fd0
add esp, 0x20
test al, al
jne 0x1006cb72
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101ba32c]
cmp byte [ebp + 0xc], 0
mov ecx, 0x10
push 0
cmove edi, ecx
add edi, eax
lea eax, [ebp - 0x20]
push 0
push 4
push eax
push edi
mov dword [ebp - 0x24], edi
call fcn.10079fb0
add esp, 0x14
test al, al
je 0x1006cb60
mov ecx, dword [ebp - 0x20]
push ebx
xor ebx, ebx
cmp ecx, edi
je 0x1006cca3
lea ecx, [ecx]
mov eax, ebx
inc ebx
cmp eax, 0xa
jge 0x1006cca3
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call fcn.10079fb0
add esp, 0x14
test al, al
je 0x1006ccb6
mov eax, dword [0x101ba324]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
test al, 1
jne 0x1006cc02
or eax, 1
cmp dword [0x7ffe0260], 0x4a62
mov dword [0x101ba324], eax
setae al
mov byte [0x101ba320], al
jmp 0x1006cc07
mov al, byte [0x101ba320]
test al, al
lea eax, [ebp - 0x1c]
push 1
cmovne ecx, dword [ebp - 8]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.100792b0
add esp, 8
test al, al
je 0x1006ccb6
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x1c]
cmp ecx, eax
jae 0x1006cc61
mov ecx, dword [esi]
lea edx, [ebp - 0x1c]
cmp ecx, edx
ja 0x1006cc61
mov edi, edx
sub edi, ecx
sar edi, 2
cmp eax, dword [esi + 8]
jne 0x1006cc4e
push 1
mov ecx, esi
call fcn.100151b0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1006cc5c
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
mov edi, dword [ebp - 0x24]
jmp 0x1006cc7b
cmp eax, dword [esi + 8]
jne 0x1006cc6f
push 1
mov ecx, esi
call fcn.100151b0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1006cc7b
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
add dword [esi + 4], 4
lea eax, [ebp - 0x20]
push 0
push 0
push 4
push eax
push dword [ebp - 0x20]
call fcn.10079fb0
add esp, 0x14
test al, al
je 0x1006ccb6
mov ecx, dword [ebp - 0x20]
cmp ecx, edi
jne 0x1006cbb0
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x1006ce50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101ba31c]
test al, 1
jne 0x1006ced8
or eax, 1
push 0x118
mov dword [0x101ba31c], eax
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.100dd9d6
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1006cec3
cmp dword [ebp - 0x11c], 5
jbe 0x1006cec3
mov al, 1
mov byte [0x101ba319], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
xor al, al
mov byte [0x101ba319], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [0x101ba319]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x100711e0
Capabilities:
Get file size
Open clipboard
Read clipboard data
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5b70
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 0x14], 0x10
mov edi, dword [esi + 0x10]
jb 0x1007121e
mov ecx, dword [esi]
jmp 0x10071220
mov ecx, esi
mov eax, 0x1c
cmp edi, eax
cmovb eax, edi
push eax
push str.x64dbg:__localhost_clipboard
push ecx
call fcn.10021b60
add esp, 0xc
test eax, eax
jne 0x100712dc
cmp edi, 0x1c
jb 0x100712dc
cmp edi, 0x1c
setne al
test eax, eax
jne 0x100712dc
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10071277
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x1007127e
call dword [sym.imp.USER32.dll_CloseClipboard]
xor al, al
jmp 0x100713a6
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x10071271
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1009edd0
add esp, 8
push esi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push dword [ebp - 0x18]
mov ecx, ebx
call fcn.100235b0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebx]
call fcn.100dd9d0
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.1006b340
mov al, 1
jmp 0x100713a6
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.1009ef30
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100712f1
mov eax, dword [eax]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x2c], 8
mov dword [ebp - 4], 0
jb 0x10071324
push dword [ebp - 0x40]
call fcn.100dd8b4
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp esi, 0xffffffff
jne 0x10071341
xor bl, bl
jmp 0x1007137d
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x10071359
mov eax, dword [ebx]
mov dword [ebx + 4], eax
mov bl, 1
jmp 0x1007137d
push edi
mov ecx, ebx
call fcn.100235b0
push 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0
push eax
push edi
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne bl
test esi, esi
je 0x100713a4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x100713a4
test byte [ebp - 0x44], 2
jne 0x100713a4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x100716a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1009ef30
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100716ce
mov eax, dword [eax]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [ebp - 8], 8
mov esi, eax
jb 0x100716f7
push dword [ebp - 0x1c]
call fcn.100dd8b4
add esp, 4
cmp esi, 0xffffffff
jne 0x10071700
xor bl, bl
jmp 0x10071721
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bl
test esi, esi
je 0x10071744
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10071744
test byte [ebp - 0x20], 2
jne 0x10071744
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x10074840
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push edi
test esi, esi
je 0x10074875
mov dword [esi], 0
cmp byte [ebp + 0x20], 0
je 0x100748a9
call dword [0x100ef84c]
test al, al
jne 0x100748a2
test esi, esi
je 0x1007488f
mov dword [esi], 3
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov edi, 0x20006
jmp 0x100748ae
mov edi, 0x20019
mov eax, dword [ebp + 0x14]
test ebx, ebx
je 0x100748c9
cmp eax, 2
je 0x100748c7
cmp eax, 1
je 0x100748c7
mov dword [ebx], 1
jmp 0x100748c9
mov dword [ebx], eax
cmp eax, 2
jne 0x100748fa
call fcn.100ca9a0
test al, al
jne 0x100748f4
test esi, esi
je 0x100748e1
mov dword [esi], 2
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
or edi, 0x100
cmp byte [ebp + 0x20], 0
je 0x10074976
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1007488f
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
call fcn.1009ef60
mov ecx, eax
add esp, 8
cmp dword [ecx + 0x14], 8
jb 0x10074942
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
inc eax
push eax
push dword [ebp - 0x2c]
push 1
push 0
push ecx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 8], 8
mov edi, eax
jb 0x100749fb
push dword [ebp - 0x1c]
call fcn.100dd8b4
add esp, 4
jmp 0x100749fb
lea eax, [ebp - 0x20]
push eax
push edi
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100749ae
test esi, esi
je 0x1007499b
mov dword [esi], 1
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
call fcn.1009ef60
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100749c5
mov eax, dword [eax]
mov edx, dword [ebp - 0x24]
push edx
push dword [ebp - 0x2c]
push 0
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 8], 8
mov edi, eax
jb 0x100749ed
push dword [ebp - 0x1c]
call fcn.100dd8b4
add esp, 4
test edi, edi
je 0x100749fb
test esi, esi
je 0x100749fb
mov dword [esi], 1
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x100764f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x10076543
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1007656f
cmp dword [ecx], edi
jne 0x10076567
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x10076577
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10076577
cmp dword [ecx], edi
jne 0x1007657a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
cmp dword [edi + 0x20], 0x10
jb 0x1007659d
push dword [edi + 0xc]
call fcn.100dd8b4
add esp, 4
mov dword [edi + 0x20], 0xf
mov dword [edi + 0x1c], 0
push edi
mov byte [edi + 0xc], 0
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100786f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x10078743
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 4], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x1007877d
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1007877d
mov eax, dword [edi]
jmp 0x10078770
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x100787c0
cmp esi, dword [edx + ecx*8]
jne 0x10078770
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x100787a7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x100787f0
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x10078812
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100787f8
mov dword [ecx], edi
jmp 0x10078812
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10078812
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.1007bfe0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007a830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x101ba428]
test al, 1
jne 0x1007a8ca
push 0
push 1
push 0
or eax, 1
mov dword [0x101ba3f0], 0x100f6818
push 0
mov dword [0x101ba428], eax
mov dword [0x101ba3f4], 0x1007c340
mov byte [0x101ba3f9], 1
mov dword [0x101ba41c], 0x3e8
mov dword [0x101ba420], 0
mov dword [0x101ba424], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0x101ba400
mov dword [0x101ba418], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0x101ba3f0
push 0x10049600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100ed880
mov dword [0x101ba3fc], eax
call fcn.100dd99f
add esp, 4
inc dword [0x101ba420]
push 0x101ba400
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 1]
mov ecx, 0x101ba3f0
push eax
mov eax, dword [0x101ba3f0]
call dword [eax]
push 0x101ba400
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 1
push dword [0x101ba418]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov esp, ebp
pop ebp
ret