joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016fd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6d3b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x10121080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x1012f720]
test al, 1
jne 0x10017115
or eax, 1
mov dword [0x1012f720], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x1010f6e0]
xorps xmm0, xmmword [0x1010f5b0]
mov dword [ebp - 0x20], 0x100f100f
mov dword [ebp - 0x1c], 0x76107208
mov word [ebp - 0x18], 0x3001
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0x30
inc eax
cmp eax, 0x1a
jb 0x10017053
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017080
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.1001fb00
mov byte [ebp - 4], 1
mov edx, dword [0x101355dc]
test edx, edx
je 0x100170a9
mov edx, dword [edx + 0x50]
jmp 0x100170ab
xor edx, edx
mov eax, dword [0x101355d4]
test eax, eax
je 0x100170b9
mov eax, dword [eax + 0x18]
jmp 0x100170bb
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10016ad0
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x1012f724], eax
cmp ecx, 0xf
jbe 0x1001710c
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100170fd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017135
push ecx
push edx
call fcn.100c6572
mov eax, dword [0x1012f724]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001711a
mov eax, dword [0x1012f724]
test eax, eax
je 0x10017122
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100d28cb
int3

Function at 0x1001eeb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f6c70
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10121080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100c6113
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100c5263
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1001f1f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10028f20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10028f52
jl 0x10028f45
test ecx, ecx
jne 0x10028f52
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10029012
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1001e9a0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10028fbe
jg 0x10028f7d
test esi, esi
je 0x10028fbe
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10028f95
mov eax, dword [esp + 0x10]
jl 0x10028f8f
cmp eax, esi
jae 0x10028f95
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100c7940
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10028fdf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10028ffb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10028f64
jl 0x10028ffb
test ecx, ecx
jne 0x10028f64
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10029056
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10029056
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.100c7940
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100290c7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1002907c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x100290b2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100d8c2d
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100290c7
cmp edi, eax
ja 0x10029090
test edi, edi
je 0x100290c7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100d8c2d
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002b880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x10121080]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi], 0x20
jb 0x1002b954
mov ecx, 1
call fcn.10030e60
lea ecx, [esp + 0x2c]
push ecx
push 0x30
lea ecx, [esp + 0x38]
push ecx
push 3
call eax
test eax, eax
jne 0x1002b954
mov dword [esp + 0xc], 0x310030
xor edx, edx
mov dword [esp + 0x10], 0x330032
mov dword [esp + 0x14], 0x350034
mov dword [esp + 0x18], 0x370036
mov dword [esp + 0x1c], 0x390038
mov dword [esp + 0x20], 0x420041
mov dword [esp + 0x24], 0x440043
mov dword [esp + 0x28], 0x460045
nop word [eax + eax]
mov cl, byte [esp + edx + 0x30]
lea esi, [esi + 4]
movzx eax, cl
inc edx
shr eax, 4
movzx eax, word [esp + eax*2 + 0xc]
mov word [esi - 4], ax
movsx eax, cl
and eax, 0xf
movzx eax, word [esp + eax*2 + 0xc]
mov word [esi - 2], ax
cmp edx, 0x10
jne 0x1002b910
mov dword [edi], 0x20
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x64]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
Function at 0x1002c170
Capabilities:
Check for time delay via queryperformancecounter
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10121080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x1002c1b2
mov eax, dword [0x1013ae08]
test eax, eax
jne 0x1002c1a0
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
mov dword [ebx + 0xc], eax
cmp eax, 8
jb 0x1002c2bb
cmp eax, 0x20
jae 0x1002c1d4
pause
inc dword [ebx + 0xc]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
jne 0x1002c2a0
mov ecx, 7
call fcn.10030e60
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x18]
push ecx
call eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x1002c212
mov ecx, dword [ebp - 0x10]
mov eax, 0xd1b71759
lea ecx, [ecx - 1]
mul ecx
shr edx, 0xd
jmp 0x1002c250
mov eax, dword [ebp - 0x10]
mov ecx, 0x5f5e100
push esi
push edi
push dword [ebp - 8]
mul ecx
push dword [ebp - 0xc]
mov edi, eax
mov esi, edx
push 0x38d7e
sub edi, 1
push 0xa4c67fff
sbb esi, 0
call fcn.100f4570
add eax, 1
adc edx, 0
push edx
push eax
push esi
push edi
call fcn.100f4570
pop edi
mov edx, eax
pop esi
lea eax, [edx + 1]
mov dword [ebx + 8], eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1002c283
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [ebx], eax
inc dword [ebx + 0xc]
mov dword [ebx + 4], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc dword [ebx + 0xc]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 8], 0
jne 0x1002c2cd
test al, 1
je 0x1002c302
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x1002c2bb
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
inc dword [ebx + 0xc]
xor ecx, ebp
pop ebx
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1002c2e5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
jmp 0x1002c2eb
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx]
sbb ecx, dword [ebx + 4]
test ecx, ecx
jb 0x1002c2aa
ja 0x1002c2fb
cmp eax, dword [ebx + 8]
jb 0x1002c2aa
mov dword [ebx + 8], 0
push 1
jmp 0x1002c2b5
Function at 0x1002d3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1012c870], 0
push ebx
push esi
push edi
je 0x1002d52e
mov ecx, dword [0x10135624]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002d52e
mov ecx, dword [0x101356a8]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002d52e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1002d400
xor edx, edx
test ecx, ecx
je 0x1002d429
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002d410
cmp edi, 0x5ff56dc5
je 0x1002d438
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002d52e
mov ecx, dword [ebp - 4]
jmp 0x1002d3e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002d52e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002d52e
movss xmm1, dword [0x1010efec]
xor ebx, ebx
cmp edx, 4
jl 0x1002d4fb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d49c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d4b7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d4d2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d4e5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002d481
cmp ebx, edx
jl 0x1002d4ff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002d52e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d523
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002d510
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100310c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f7d85
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10121080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10034810
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100311dc
cmp dword [0x1013aaa8], 0xfffffff
je 0x100311f3
mov dword [ebp - 0x1c], 0x1013aaa4
mov dword [ebp - 4], eax
push 0x10
mov dword [ebp - 0x18], eax
call fcn.100c6113
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1013aaa8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010f8b0]
mov eax, dword [0x1013aabc]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010f8b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1013aaa0]
jbe 0x100311d1
call fcn.10033960
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10034810
mov ecx, dword [eax]
jmp 0x100311d4
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.100339e0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100c5091
int3
Function at 0x10031940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10031a96
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100c6572
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100319f9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100319b7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10031a8c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10031a0d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10031a10
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10031a8c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100c6572
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x10031a9d
cmp esi, eax
jne 0x10031a67
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10031a20
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100322e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10121080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push edx
push 0x80000002
mov byte [ebp - 0x11], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10032366
mov eax, dword [edi]
push esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov dword [edi], 0
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test eax, eax
jne 0x1003234c
mov eax, dword [ebp - 8]
mov dword [edi], eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
xor ecx, ebp
pop edi
pop ebx
call fcn.100c60f2
mov esp, ebp
pop ebp
ret
Function at 0x10032880
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f7ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10121080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0
push 0
push 0
push 2
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0x80000000
mov dword [ebx + 0x10], 0xffffffff
mov ecx, dword [eax]
push 0
push ecx
mov dword [ebp - 0x58], ecx
mov byte [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
je 0x10032a58
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [0x1013ade4], 0
jne 0x10032919
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, 4
call fcn.10030e60
push 0
push 0x10
lea ecx, [ebp - 0x28]
push ecx
push 0
push esi
call eax
test eax, eax
je 0x1003294a
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x5c]
call fcn.1002bb10
push ecx
mov eax, ecx
jmp 0x10032a69
mov eax, dword [ebp - 0x1c]
test eax, eax
jl 0x10032a32
mov edi, dword [ebp - 0x20]
jg 0x10032964
test edi, edi
jb 0x10032a32
test eax, eax
ja 0x10032a32
jb 0x10032975
cmp edi, 0xffffffff
ja 0x10032a32
push 0
push edi
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
jne 0x1003299f
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x5c]
call fcn.1002bb10
push ecx
mov eax, ecx
jmp 0x10032a69
push dword [ebp - 0x60]
mov dword [ebx], eax
mov dword [ebx + 8], 0
mov dword [ebx + 4], edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
mov edi, eax
call esi
push 2
push 0
push 0
lea ecx, [ebx + 0x10]
push ecx
push edi
push dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x10032a12
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x18]
call fcn.1002bb10
mov ecx, ebx
call fcn.1002be60
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x8c]
call fcn.1002bc00
push 0x1011f83c
lea eax, [ebp - 0x8c]
jmp 0x10032a7a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c60f2
mov esp, ebp
pop ebp
ret 0x1c
push 0x12
lea ecx, [ebp - 0x5c]
call fcn.1002baf0
push ecx
mov eax, ecx
lea ecx, [ebp - 0x8c]
push eax
call fcn.1002bc00
push 0x1011f83c
lea eax, [ebp - 0x8c]
jmp 0x10032a7a
call sub.KERNEL32.dll_GetLastError
push eax
lea ecx, [ebp - 0x18]
call fcn.1002bb10
push ecx
mov eax, ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.1002bc00
push 0x1011f83c
lea eax, [ebp - 0x54]
push eax
call fcn.100c78cb
int3
Function at 0x10033b40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10033cad
lea eax, [ecx - 1]
mov esi, dword [0x1013aaa4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1013aaac
lea eax, [edi + edi]
push eax
call fcn.10031c00
mov eax, dword [0x1013aaa4]
lea ebx, [edi - 1]
mov dword [0x1013aab8], ebx
mov dword [0x1013aabc], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10033ca4
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1013aaac]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10033c02
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10033c6f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10033c3c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10033c34
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10033c6f
cmp ebx, edx
je 0x10033c4c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10033c80
cmp ebx, edx
jne 0x10033c40
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10033ca4
mov ebx, dword [0x1013aab8]
jmp 0x10033bb0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10033c6f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.100c5091
int3