joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d6510
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.100af030
mov dword [ebp - 4], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [0x1047e07c]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x30]
cvtsi2ss xmm0, edx
push ecx
movss dword [esp], xmm0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x24]
call fcn.10027ec0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [0x1047e080]
mov edx, dword [ebp - 0x18]
sbb edx, dword [0x1047e084]
call fcn.102b9910
cvtsd2ss xmm0, xmm0
mov edx, dword [0x1047e08c]
mov ecx, dword [0x1047e088]
movss dword [ebp - 0x14], xmm0
call fcn.102b9910
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x14]
divss xmm1, xmm0
mov edx, dword [ebp - 4]
movss dword [edx + 0x10], xmm1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [0x1047e080], eax
mov dword [0x1047e084], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x100d65e2
mov dword [ebp - 8], 1
jmp 0x100d65e9
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 8]
mov byte [eax + 0xf8], cl
call fcn.100d5e70
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0xa8]
test eax, eax
je 0x100d6611
mov dword [ebp - 0xc], 0xffffffff
jmp 0x100d6619
call fcn.100b2590
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x10430f50]
cmp edx, dword [ebp - 0x10]
je 0x100d6637
mov eax, dword [ebp - 0x10]
mov dword [0x10430f50], eax
call fcn.100d5d80
call fcn.100d5f90
mov esp, ebp
pop ebp
ret
Function at 0x100dd3b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0xc], 8
jb 0x100dd4c5
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, dword [ebp - 4]
and ecx, 0xff
xor eax, ecx
mov edx, 1
shl edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
xor edx, ecx
mov eax, dword [eax*4 + 0x10311928]
xor eax, dword [edx*4 + 0x103110f0]
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + ecx]
mov edx, dword [ebp - 4]
shr edx, 0x10
and edx, 0xff
xor ecx, edx
xor eax, dword [ecx*4 + 0x10311e38]
mov ecx, 1
imul edx, ecx, 3
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov ecx, dword [ebp - 4]
shr ecx, 0x18
and ecx, 0xff
xor edx, ecx
xor eax, dword [edx*4 + 0x10312238]
mov edx, 1
shl edx, 2
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor eax, dword [edx*4 + 0x10312638]
mov ecx, 1
imul edx, ecx, 5
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor eax, dword [edx*4 + 0x10312fa8]
mov ecx, 1
imul edx, ecx, 6
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor eax, dword [edx*4 + 0x103114f0]
mov ecx, 1
imul edx, ecx, 7
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
xor eax, dword [edx*4 + 0x10312b10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 8
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 8
mov dword [ebp + 0xc], ecx
jmp 0x100dd3bd
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 8], 0
je 0x100dd50a
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
xor edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 4]
shr eax, 8
xor eax, dword [edx*4 + 0x10312b10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jmp 0x100dd4c5
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x100e4800
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
lea ecx, [ebp - 0x1b8]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100e4852
push str.WSAStartup_failed
call fcn.10069720
push eax
mov edx, dword [ebp - 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.100e4720
push 0x103527e4
lea eax, [ebp - 0x28]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
movzx ecx, word [ebp - 0x1b8]
and ecx, 0xff
movzx edx, cl
cmp edx, 2
jne 0x100e487e
movzx eax, word [ebp - 0x1b8]
shr eax, 8
and eax, 0xff
movzx ecx, al
cmp ecx, 2
je 0x100e489f
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [ebp - 0x14]
call fcn.1005bb40
push 0x103528f4
lea edx, [ebp - 0x14]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100e4a50
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x100e4a9c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x100e4a9c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
jmp 0x100e4a70
cmp dword [ebp - 4], 0xffffffff
jne 0x100e4ad5
call fcn.10069720
mov dword [ebp - 0xc], eax
call fcn.100e48d0
mov dword [ebp - 0x10], eax
push str.Failed_to_connect
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
call fcn.100e4720
push 0x103527e4
lea ecx, [ebp - 0x24]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
mov esp, ebp
pop ebp
ret 8
Function at 0x101076b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c42cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x88
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x74]
call fcn.10107660
mov byte [ebp - 0x74], 0
mov byte [ebp - 0x73], 1
lea eax, [ebp - 0x74]
push eax
call fcn.1000d300
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x64], edx
mov al, byte [eax + 8]
mov byte [ebp - 0x60], al
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x1c], eax
sub esp, 0xc
mov edx, esp
mov eax, dword [ebp - 0x68]
mov dword [edx], eax
mov ecx, dword [ebp - 0x64]
mov dword [edx + 4], ecx
movzx eax, byte [ebp - 0x60]
mov byte [edx + 8], al
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.1010f0c0
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x10]
push eax
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x54]
call fcn.1010f1d0
mov eax, dword [ebx + 0x30]
push eax
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebx + 0x2c]
push ecx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x30], eax
mov edx, dword [ebx + 0x28]
push edx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x24]
push eax
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebx + 0x20]
push ecx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x3c], eax
mov edx, dword [ebx + 0x1c]
push edx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x18]
push eax
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, dword [ebx + 0x14]
push ecx
call fcn.1000d300
add esp, 4
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.1010f290
add esp, 0x24
mov dword [ebp - 0x4c], eax
mov dl, byte [ebp - 0x12]
mov byte [ebp - 0x11], dl
mov eax, dword [ebp - 0x4c]
push eax
movzx ecx, byte [ebp - 0x11]
push ecx
lea ecx, [ebp - 0x54]
call fcn.1010f340
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebx + 8]
call fcn.1010c470
mov eax, dword [ebp - 0x18]
or eax, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100f6dc0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x2c
Function at 0x1020e1c0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push str.csgo_sound
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 4], 0
push 0x10334cd0
push str.csgo_soundmetallic.wav
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0xfcbc
push 1
push str.RIFF
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x1020e220
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1020e23f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1020e26f
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.1020e220
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1020e470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c9605
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x4e64
call fcn.102ba650
mov dword [ebp - 0x10], 0x4e20
push 0x4e20
push 0
lea eax, [ebp - 0x4e70]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.100250a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.100250a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x4e70]
push edx
push 0
push 0xffff
push str.login
push str.Softwaregsfun
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
push eax
lea ecx, [ebp - 0x30]
call fcn.1005b850
push str.sano
lea eax, [ebp - 0x30]
push eax
call fcn.10073d00
add esp, 8
mov ecx, str.Spencer
test ecx, ecx
je 0x1020e538
mov edx, 0x8ac72304
mov dword [ebp - 0x18], 0x89e80000
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.10073630
push eax
call fcn.10073d40
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.1000c760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1000c760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1020e9f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
jne 0x1020ea64
call fcn.10210650
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0xc]
call fcn.10210870
call eax
mov dword [ebp - 8], eax
call fcn.10210a90
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
je 0x1020ea4d
cmp dword [ebp - 4], 0x100
je 0x1020ea4d
call fcn.10210cb0
mov dword [ebp - 0x14], eax
push 0x80
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0x14]
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x1020e640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10211580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x102115c5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1021165b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x102115e8
jmp 0x1021165b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x1021160b
jmp 0x102115bc
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0xe463da3c
jne 0x10211656
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1021165d
jmp 0x102115bc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10211670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x102116b5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1021174b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x102116d8
jmp 0x1021174b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x102116fb
jmp 0x102116ac
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0x1c59c83
jne 0x10211746
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1021174d
jmp 0x102116ac
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10211760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x102117a5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1021183b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x102117c8
jmp 0x1021183b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x102117eb
jmp 0x1021179c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0x6dd8a845
jne 0x10211836
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1021183d
jmp 0x1021179c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10211850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x10211895
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1021192b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x102118b8
jmp 0x1021192b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x102118db
jmp 0x1021188c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0xb9958901
jne 0x10211926
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1021192d
jmp 0x1021188c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10211940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x10211985
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x10211a1b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x102119a8
jmp 0x10211a1b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x102119cb
jmp 0x1021197c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0x60993b9d
jne 0x10211a16
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x10211a1d
jmp 0x1021197c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10211e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x10211e45
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x10211edb
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x10211e68
jmp 0x10211edb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x10211e8b
jmp 0x10211e3c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1020e220
add esp, 8
cmp eax, 0xf652bc95
jne 0x10211ed6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x10211edd
jmp 0x10211e3c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10213800
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov dword [ebp - 8], 0
jmp 0x10213821
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 5
jge 0x10213847
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1021383d
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x10213847
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10213818
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
test edx, edx
jne 0x1021386d
call fcn.10213560
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1021386d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
call dword [ebp - 0x10]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4