joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fb1a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.100bfb30
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [0x1089d000]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x38]
cvtsi2ss xmm0, edx
push ecx
movss dword [esp], xmm0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
cvtsi2ss xmm0, eax
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x2c]
call fcn.10013b00
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x1089d008]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x1089d00c]
call fcn.1028a790
cvtsd2ss xmm0, xmm0
mov edx, dword [0x1089d014]
mov ecx, dword [0x1089d010]
movss dword [ebp - 0x1c], xmm0
call fcn.1028a790
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x1c]
divss xmm1, xmm0
mov edx, dword [ebp - 4]
movss dword [edx + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x1089d008], eax
mov dword [0x1089d00c], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x100fb272
mov dword [ebp - 8], 1
jmp 0x100fb279
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 8]
mov byte [eax + 0xf0], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x100fb2a1
mov dword [ebp - 0xc], 1
jmp 0x100fb2a8
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0xf1], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x100fb2d0
mov dword [ebp - 0x10], 1
jmp 0x100fb2d7
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0xf2], cl
mov edx, dword [ebp - 4]
mov byte [edx + 0xf3], 0
call fcn.100fb0a0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xa4]
test ecx, ecx
je 0x100fb309
mov dword [ebp - 0x14], 0xffffffff
jmp 0x100fb311
call fcn.100c2f70
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
mov eax, dword [0x106b4cbc]
cmp eax, dword [ebp - 0x18]
je 0x100fb32f
mov ecx, dword [ebp - 0x18]
mov dword [0x106b4cbc], ecx
call fcn.100fafb0
mov esp, ebp
pop ebp
ret
Function at 0x1011c310
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
lea ecx, [ebp - 0x1b8]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1011c362
push str.WSAStartup_failed
call fcn.1011c240
push eax
mov edx, dword [ebp - 8]
push edx
lea ecx, [ebp - 0x28]
call fcn.1011be70
push 0x102ff030
lea eax, [ebp - 0x28]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
movzx ecx, word [ebp - 0x1b8]
and ecx, 0xff
movzx edx, cl
cmp edx, 2
jne 0x1011c38e
movzx eax, word [ebp - 0x1b8]
shr eax, 8
and eax, 0xff
movzx ecx, al
cmp ecx, 2
je 0x1011c3af
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [ebp - 0x14]
call fcn.10060140
push 0x102ff06c
lea edx, [ebp - 0x14]
push edx
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1011c560
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1011c5ac
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x1011c5ac
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 4], eax
jmp 0x1011c580
cmp dword [ebp - 4], 0xffffffff
jne 0x1011c5e5
call fcn.1011c240
mov dword [ebp - 0xc], eax
call fcn.1011c3e0
mov dword [ebp - 0x10], eax
push str.Failed_to_connect
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
call fcn.1011be70
push 0x102ff030
lea ecx, [ebp - 0x24]
push ecx
call sub.VCRUNTIME140.dll__CxxThrowException
mov esp, ebp
pop ebp
ret 8
Function at 0x101fb9d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x101fb9ef
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x101fba1f
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.101fb9d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x101fc100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
jne 0x101fc18b
call fcn.101fe130
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0xc]
call fcn.101fe340
call eax
mov dword [ebp - 8], eax
call fcn.101fe550
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [ebp - 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
je 0x101fc15d
cmp dword [ebp - 4], 0x100
je 0x101fc15d
call fcn.101fe760
mov dword [ebp - 0x14], eax
push 0x80
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0x14]
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x101fc0c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x101fba30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x101ff530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101ff575
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x101ff60b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101ff598
jmp 0x101ff60b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101ff5bb
jmp 0x101ff56c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0xe463da3c
jne 0x101ff606
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x101ff60d
jmp 0x101ff56c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101ff7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101ff7e5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x101ff87b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101ff808
jmp 0x101ff87b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101ff82b
jmp 0x101ff7dc
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0x1c59c83
jne 0x101ff876
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x101ff87d
jmp 0x101ff7dc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101ff890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101ff8d5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x101ff96b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101ff8f8
jmp 0x101ff96b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101ff91b
jmp 0x101ff8cc
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0x6dd8a845
jne 0x101ff966
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x101ff96d
jmp 0x101ff8cc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101ff980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101ff9c5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x101ffa5b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101ff9e8
jmp 0x101ffa5b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101ffa0b
jmp 0x101ff9bc
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0xb9958901
jne 0x101ffa56
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x101ffa5d
jmp 0x101ff9bc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101ffa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101ffab5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x101ffb4b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101ffad8
jmp 0x101ffb4b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101ffafb
jmp 0x101ffaac
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0x60993b9d
jne 0x101ffb46
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x101ffb4d
jmp 0x101ffaac
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101fff40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x101fff85
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1020001b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x101fffa8
jmp 0x1020001b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x101fffcb
jmp 0x101fff7c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0xf652bc95
jne 0x10200016
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1020001d
jmp 0x101fff7c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10200030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x10200075
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1020010b
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x10200098
jmp 0x1020010b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x102000bb
jmp 0x1020006c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.101fb9d0
add esp, 8
cmp eax, 0x76991bcc
jne 0x10200106
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1020010d
jmp 0x1020006c
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1020f2a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1020f2d3
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor eax, dword [ebp + 0xc]
mov ecx, 0x1000193
mul ecx
push eax
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.1020f2a0
add esp, 8
mov dword [ebp - 4], eax
jmp 0x1020f2d9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1020f2e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1020f31e
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 8]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], eax
jmp 0x1020f2ed
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1026efe0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x103030c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str._5_3
push esi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push 0x102b5674
push edi
mov dword [ebp - 0x110], eax
call fcn.1026b080
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1026f03f
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1026f0a2
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.1026a9d0
push 0xffffffffffffffff
push edi
call fcn.1026bab0
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.1026b8c0
add esp, 0x1c
test esi, esi
jne 0x1026f0a2
push 0x102b567c
push 0x102b5680
push ebx
push edi
call fcn.10268f20
push dword [ebp - 0x110]
push 0x102b5684
push eax
push edi
call fcn.10268f20
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.1026b5d0
push 0xfffffffffffffffe
push edi
call fcn.1026b8c0
add esp, 0x34
jmp 0x1026f0b1
push dword [ebp - 0x110]
push edi
call fcn.1026b1b0
add esp, 8
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1026f11f
cmp eax, 0x105
je 0x1026f11f
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x1026f11f
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x102b5648
push 0
push 0xffffffffffffffff
push edi
call fcn.1026bb90
add esp, 0xc
push eax
push edi
call fcn.10268f20
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.1026b5d0
push 0xfffffffffffffffe
push edi
call fcn.1026b8c0
add esp, 0x24
jmp 0x1026f12d
push str.unable_to_get_ModuleFileName
push edi
call fcn.10268cb0
add esp, 8
push dword [ebp - 0x114]
push 0xfffffffffffffffd
push edi
call fcn.1026b670
push 0xfffffffffffffffe
push edi
call fcn.1026b8c0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1028a262
mov esp, ebp
pop ebp
ret
Function at 0x10275db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x103030c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, 1
push ebx
mov dword [ebp - 0xc], eax
call fcn.1026aba0
add esp, 4
sub eax, edi
je 0x10275ea0
dec eax
push edi
push ebx
mov dword [ebp - 0x10], eax
call fcn.1026bd50
add esp, 8
cmp eax, 3
jne 0x10275e70
push edi
push ebx
call fcn.1026ace0
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x10275e23
call fcn.1026bb10
push edx
push eax
push str._lld
push dword [ebp - 0xc]
call fcn.102685c0
add esp, 0x1c
jmp 0x10275e3e
call fcn.1026bc20
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp - 0xc]
call fcn.102685c0
add esp, 0x10
test esi, esi
je 0x10275e46
test eax, eax
jg 0x10275e99
xor esi, esi
mov eax, dword [ebp - 0x10]
inc edi
test eax, eax
jne 0x10275de5
test esi, esi
jne 0x10275ea0
push esi
push esi
push ebx
call fcn.10268dd0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1028a262
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push ebx
call fcn.102689d0
add esp, 0xc
test esi, esi
je 0x10275e46
push dword [ebp - 0xc]
push dword [ebp - 8]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 8]
jne 0x10275e46
mov esi, 1
jmp 0x10275e48
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1028a262
mov esp, ebp
pop ebp
ret