joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003094
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x1006040]
push ebx
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
mov dword [ebp - 0x908], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0x3ea
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1003237
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
sar eax, 0x10
and eax, 0x1fff
cmp eax, 0x100
jne 0x1003112
push edi
push 0x200
lea eax, [ebp - 0x504]
push eax
push edi
and esi, 0xffff
push esi
push ebx
push 0x800
jmp 0x10031a8
cmp esi, edi
jge 0x100311b
cmp esi, 0xffffff9c
jg 0x100311f
cmp eax, edi
jne 0x100318d
push 0x10012fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, edi
je 0x1003236
cmp esi, 0xffff0000
jbe 0x1003144
and esi, 0xffff
jmp 0x100315a
test esi, 0x10000000
je 0x1003154
add esi, 0x7000f000
jmp 0x100315a
add esi, 0x8000e000
push edi
push 0x200
lea eax, [ebp - 0x504]
push eax
push edi
push esi
push ebx
push 0x800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
push ebx
jne 0x1003185
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1003236
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10031b6
push edi
push 0x200
lea eax, [ebp - 0x504]
push eax
push edi
and esi, 0xffff
push esi
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1003236
cmp dword [ebp - 0x908], edi
je 0x1003223
cmp dword [ebp - 0x908], 0xffffffff
je 0x1003223
push edi
push edi
push 0x400
lea eax, [ebp - 0x904]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x504]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x10012f8
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x904]
push eax
push dword [ebp - 0x908]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1003236
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.0100282d
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01004bb2
leave
ret 8
Function at 0x1004bb2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006040]
jne 0x1004bc3
test ecx, 0xffff0000
jne 0x1004bc3
ret
jmp fcn.01004bcd

Function at 0x1004cb2
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001360
call fcn.01004e88
cmp word [0x1000000], 0x5a4d
jne 0x1004cf0
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1004cf0
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1004d09
cmp ecx, 0x20b
je 0x1004cf6
and dword [ebp - 0x1c], 0
jmp 0x1004d1d
cmp dword [eax + 0x84], 0xe
jbe 0x1004cf0
xor ecx, ecx
cmp dword [eax + 0xf8], ecx
jmp 0x1004d17
cmp dword [eax + 0x74], 0xe
jbe 0x1004cf0
xor ecx, ecx
cmp dword [eax + 0xe8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100637c], 0xffffffff
or dword [0x1006380], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1006378]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1006374]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1006384], eax
call fcn.01004e7e
cmp dword [0x1006044], 0
jne 0x1004d7a
push fcn.01004e7e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01004e67
push 0x1001170
push 0x100116c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1006370]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100636c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1001168
push 0x1001160
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01003279
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1004df2
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1004e27
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01004ec3
ret
Function at 0x100110a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100110f8
cmp byte [esi + ebx - 1], 0xa
je 0x100110cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x100210a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10011720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x100118f8
mov edi, dword [0x100210a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10011807
test byte [0x10012054], 8
jne 0x100118a0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10012064], 8
jne 0x10011860
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100117a9
cmp esi, 3
jbe 0x10011818
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100117ba
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x1001b348]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100117a9
mov dword [esp], 0x10012064
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10011780
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10011780
mov dword [esp], 0x10012054
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1001176b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10011773
mov eax, 0xffffffff
jmp 0x10011807
Function at 0x401000
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
call fcn.004010a1
call fcn.00401158
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x210]
push 0x403038
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x210]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteFile:__d_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
pop ecx
call fcn.0040139d
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push str._svchost.exe
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x108]
push eax
call fcn.0040125a
lea eax, [ebp - 0x108]
push eax
call fcn.00401347
add esp, 0x10
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x4010a1
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
push 0x403048
xor esi, esi
push 0x403044
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
cmp edi, esi
je 0x401145
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x401145
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x401145
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x401145
lea eax, [ebp - 0x88]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x88]
push 0x403038
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x88]
pop ecx
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, esi
je 0x401145
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40114a
or eax, 0xffffffff
jmp 0x401153
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401158
Capabilities:
Create service
Delete service
Get common file path
Start service

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, str.uay.sys
lea eax, [esp + 0x14]
push esi
push eax
lea eax, [esp + 0x124]
push str._s_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, 0xf01ff
mov ebp, eax
push ebx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x130]
push eax
push 1
push 3
push 1
push ebx
push esi
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4011ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreAteService_error:__d_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
pop ecx
push dword [esp + 0x10]
call edi
push ebx
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x401228
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenService_error:__d_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
pop ecx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.stArtService__d_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
pop ecx
push esi
call edi
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x214
ret
Function at 0x40125a
Capabilities:
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
lea eax, [ebp - 0x12c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x12c]
push str.userinit.exe
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.MSVCRT.dll__stat]
mov esi, dword [sym.imp.MSVCRT.dll_fopen]
lea eax, [ebp - 0x12c]
push 0x4030dc
push eax
call esi
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4012bd
push str.open_file_fAiled_n
jmp 0x4012d5
push 0x4030c4
push dword [ebp + 8]
call esi
pop ecx
mov dword [ebp + 8], eax
test eax, eax
pop ecx
jne 0x4012e1
push str.creAte_file_fAiled_n
call dword [sym.imp.MSVCRT.dll_printf]
pop ecx
or eax, 0xffffffff
jmp 0x401343
push edi
push 0
push dword [0x403014]
push ebx
call dword [sym.imp.MSVCRT.dll_fseek]
mov esi, dword [ebp - 0x10]
sub esi, dword [0x403014]
push esi
push str.length:__d_n
call dword [sym.imp.MSVCRT.dll_printf]
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
push ebx
mov edi, eax
push 1
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fread]
push dword [ebp + 8]
push 1
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
push ebx
call esi
add esp, 0x40
push dword [ebp + 8]
call esi
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401347
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
pop edi
leave
ret
Function at 0x1000c320
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x270
jne 0x1000c33e
mov ecx, dword [ebp - 8]
call fcn.1000c3c0
jmp 0x1000c351
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4e0
jb 0x1000c351
mov ecx, dword [ebp - 8]
call fcn.1000c450
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
mov edx, dword [ebp - 8]
and ecx, dword [edx + 0x1384]
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1000c3c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x1000c3db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x1000c447
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1000c41f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1000c426
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1000c3d2
mov esp, ebp
pop ebp
ret
Function at 0x1000c450
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x1000c46b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x1000c4d7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x1000c4af
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x1000c4b6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1000c462
jmp 0x1000c4e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x1000c54e
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x1000c526
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x1000c52d
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x1000c4d9
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x1000c58c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x1000c593
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret

Function at 0x10065360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1006537f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x100653af
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.10065360
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10072e50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10128e78
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x1015e074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0x224
mov eax, dword [ebp + 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10072fd6
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10072fd6
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x28]
call fcn.100039e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019d20
mov ecx, dword [eax]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x260], edx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x28]
call fcn.1002f0f0
mov ecx, dword [eax]
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x264], edx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019d20
mov ecx, dword [eax]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x268], edx
push 0x100942ad
mov eax, dword [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x268]
push edx
lea eax, [ebp - 0x27c]
push eax
call fcn.1002f240
add esp, 0x14
push 0x811c9dc5
lea ecx, [ebp - 0x28]
call fcn.1000ff40
push eax
call fcn.10065360
add esp, 8
cmp eax, dword [ebp + 8]
jne 0x10072fc2
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x26c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003900
mov eax, dword [ebp - 0x26c]
jmp 0x10072fe5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003900
jmp 0x10072eb3
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10089497
mov esp, ebp
pop ebp
ret
Function at 0x10073000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x10073014
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x10073019
mov eax, dword [ebp + 8]
jmp 0x10073080
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x1007303c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x10073071
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jb 0x10073066
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 8], edx
jae 0x10073066
jmp 0x10073071
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
jmp 0x10073033
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
sub eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
mov esp, ebp
pop ebp
ret