joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bcad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4bcae0
xor eax, eax
jmp 0x4bcc7d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x4bcc3e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x524db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x524db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x524db0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x524db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x524db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x524db0]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x524db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x524db0]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x4bcae9
cmp dword [ebp + 0x10], 0
je 0x4bcc77
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x524db0]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x4bcc44
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4c7500
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x549944]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], ecx
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_64.0.3282.140_Safari_537.36
call fcn.004c70d0
mov eax, dword [eax + 0x100]
call eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov edx, dword [ebp - 0x44]
cmp dword [edx], 0
jne 0x4c7544
xor eax, eax
jmp 0x4c7661
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x64
call fcn.004a4ae0
push 0x3c
push 0
lea ecx, [ebp - 0x40]
push ecx
call fcn.004e8ed0
add esp, 0xc
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 8], 1
lea edx, [ebp - 0x40]
push edx
push 0
push 0
mov ecx, dword [ebp + 8]
call fcn.00499a10
push eax
call fcn.004c70d0
mov eax, dword [eax + 0x10c]
call eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x6c]
call fcn.00495700
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0xc
call fcn.00496a10
lea ecx, [ebp - 0x6c]
call fcn.00496520
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x84]
call fcn.00495700
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x24
call fcn.00496a10
lea ecx, [ebp - 0x84]
call fcn.00496520
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea ecx, [ebp - 0x9c]
call fcn.00495700
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x3c
call fcn.00496a10
lea ecx, [ebp - 0x9c]
call fcn.00496520
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
mov dword [ecx + 0x54], edx
mov eax, dword [ebp - 0x44]
mov cx, word [ebp - 0x28]
mov word [eax + 0x58], cx
mov edx, dword [ebp - 0x44]
add edx, 0x3c
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x24
call fcn.00499670
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e5962
mov esp, ebp
pop ebp
ret 8
Function at 0x4d4ba0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x549944]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x4d4bc7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4d4bce
mov al, 1
jmp 0x4d4ca9
call fcn.0049a890
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.0049a890
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.0049a8f0
add esp, 8
movzx eax, al
test eax, eax
je 0x4d4c0a
xor al, al
jmp 0x4d4ca9
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.004d9ca0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4d4c46
cmp dword [ebp - 0x34], 1
je 0x4d4c4d
cmp dword [ebp - 0x34], 3
je 0x4d4c9c
jmp 0x4d4ca7
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x4d4c7c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.004f790c
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4d4c7c
xor al, al
jmp 0x4d4ca9
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4d4c90
mov dword [ebp - 0x3c], 1
jmp 0x4d4c97
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x4d4ca9
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x4d4ca9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e5962
mov esp, ebp
pop ebp
ret
Function at 0x50174f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005015c5

Function at 0x515000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x549944]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5286ec
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.004f5b7f
add esp, 0xc
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jne 0x5150b4
mov edx, dword [ebp - 0x5c]
push edx
push 1
push 0x40
lea eax, [ebp - 0x58]
push eax
call fcn.004f5dc3
add esp, 0x10
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call fcn.004f6154
add esp, 0xc
mov eax, dword [ebp - 0x5c]
push eax
push 1
push 0x14
lea ecx, [ebp - 0x18]
push ecx
call fcn.004f5dc3
add esp, 0x10
mov edx, dword [ebp - 0x5c]
push edx
call fcn.004f5957
add esp, 4
movzx eax, word [ebp - 0x18]
cmp eax, 0x14c
jne 0x51508c
xor al, al
jmp 0x5150b6
movzx ecx, word [ebp - 0x18]
cmp ecx, 0x200
jne 0x51509e
mov al, 1
jmp 0x5150b6
movzx edx, word [ebp - 0x18]
cmp edx, 0x8664
jne 0x5150b0
mov al, 1
jmp 0x5150b6
xor al, al
jmp 0x5150b6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e5962
mov esp, ebp
pop ebp
ret
Function at 0x515f30
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 1
push str.SeCreateTokenPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeAssignPrimaryTokenPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeLockMemoryPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeIncreaseQuotaPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeUnsolicitedInputPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeMachineAccountPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeTcbPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeSecurityPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeTakeOwnershipPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeLoadDriverPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeSystemProfilePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeSystemtimePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeProfileSingleProcessPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeIncreaseBasePriorityPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeCreatePagefilePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeCreatePermanentPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeBackupPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeRestorePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeShutdownPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeDebugPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeAuditPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeSystemEnvironmentPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeChangeNotifyPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeRemoteShutdownPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeUndockPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeSyncAgentPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeEnableDelegationPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeManageVolumePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeImpersonatePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeCreateGlobalPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeTrustedCredManAccessPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeRelabelPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeIncreaseWorkingSetPrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeTimeZonePrivilege
call fcn.00516150
add esp, 8
push 1
push str.SeCreateSymbolicLinkPrivilege
call fcn.00516150
add esp, 8
pop ebp
ret
Function at 0x1000e780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c850
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10027008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
test esi, esi
je 0x1000e8f2
cmp byte [esi + 0x54], 0
je 0x1000e8f2
add esi, 0x1c
xorps xmm0, xmm0
xor bl, bl
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], bl
test esi, esi
je 0x1000e806
mov eax, dword [esi]
test eax, eax
je 0x1000e803
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000e7fd
cmp eax, 0x80
je 0x1000e7fd
xor bl, bl
jmp 0x1000e803
mov byte [esi + 4], 1
mov bl, 1
mov byte [ebp - 0x18], bl
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
cmp dword [eax + 0x14], 8
jb 0x1000e818
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000e8cb
mov edx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10017c80
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x24]
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x1000e8b9
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000e8af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000e8af
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1001a342
add esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1000e8eb
test bl, bl
je 0x1000e8eb
mov eax, dword [esi]
test eax, eax
je 0x1000e8e7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001a301
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f320
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c967
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10027008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x30
call fcn.1001a312
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], 0
push 0x30
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [esi], vtable.RC::DmAvCore::IAvTaskPool.0
mov byte [ebp - 4], 1
lea eax, [esi + 0x24]
mov dword [esi], vtable.RC::DmAvCore::RCImplTaskPool.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0x1000
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x20], 0
mov dword [eax], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x20], eax
test eax, eax
je 0x1000f496
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.kernel32.dll
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f428
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f428
lea ecx, [ebp - 0x34]
push ecx
call eax
mov eax, dword [ebp - 0x20]
cmp eax, 0xff
jae 0x1000f428
test eax, eax
jne 0x1000f435
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
call fcn.1000ee60
mov dword [esi + 4], eax
test eax, eax
je 0x1000f496
mov ecx, 0x20
call fcn.1000ee60
mov dword [esi + 8], eax
test eax, eax
je 0x1000f496
mov ecx, 0x20
call fcn.1000f1a0
mov dword [esi + 0xc], eax
test eax, eax
je 0x1000f496
mov edx, dword [eax]
mov ecx, eax
push esi
push 0x10010c90
call dword [edx + 4]
mov ecx, dword [esi + 0x14]
add ecx, ecx
call fcn.1000f1a0
mov dword [esi + 0x10], eax
test eax, eax
je 0x1000f496
mov edx, dword [eax]
mov ecx, eax
push 0
push 0
call dword [edx + 4]
mov eax, esi
jmp 0x1000f498
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001a301
mov esp, ebp
pop ebp
ret

Function at 0x1000f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
xorps xmm0, xmm0
mov eax, ecx
movlpd qword [esp + 0x10], xmm0
mov edx, dword [esp + 0x14]
xor esi, esi
mov dword [esp + 0xc], eax
test edi, edi
je 0x1000f520
mov ebx, dword [esp + 0x10]
nop dword [eax + eax]
movzx eax, word [eax + esi*2]
inc esi
movzx ecx, bl
xor ecx, eax
mov eax, dword [esp + 0xc]
shrd ebx, edx, 8
shr edx, 8
xor ebx, dword [ecx*8 + 0x1001ef10]
xor edx, dword [ecx*8 + 0x1001ef14]
cmp esi, edi
jb 0x1000f4f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010640
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 8]
push esi
push edi
test edx, edx
je 0x100106a7
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [edx + 4]
shr eax, 0x10
dec edi
xor eax, esi
mov edx, dword [edx]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, edi
mov ecx, dword [edx + eax*8]
cmp ecx, esi
je 0x1001068e
nop
test ecx, ecx
je 0x100106a7
inc eax
and eax, edi
mov ecx, dword [edx + eax*8]
cmp ecx, esi
jne 0x10010680
mov ecx, dword [edx + eax*8 + 4]
test ecx, ecx
je 0x100106a7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001069f
mov dword [eax], ecx
pop edi
mov al, 1
pop esi
pop ebp
ret 8
pop edi
xor al, al
pop esi
pop ebp
ret 8

Function at 0x10010790
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ecx + 8]
test edi, edi
jne 0x100107a2
xor al, al
pop edi
pop ebp
ret 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 0x10
xor eax, esi
mov edx, dword [edi]
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [edi + 4]
dec eax
and ecx, eax
mov eax, dword [edx + ecx*8]
mov dword [ebp + 8], ecx
lea ebx, [ecx*8]
cmp eax, esi
je 0x1001082f
test eax, eax
je 0x100107ea
cmp eax, 0xffffffff
jne 0x10010814
add edx, ebx
mov ecx, esi
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x1001082f
cmp eax, esi
je 0x1001082f
mov edx, dword [edi]
mov ecx, esi
add edx, ebx
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x1001082f
cmp eax, esi
je 0x1001082f
mov edx, dword [edi]
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 4]
inc eax
dec ecx
and eax, ecx
mov dword [ebp + 8], eax
lea ebx, [eax*8]
mov eax, dword [ebx + edx]
cmp eax, esi
jne 0x100107e1
mov ecx, dword [edi]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
pop esi
mov dword [ecx + ebx*8 + 4], eax
mov al, 1
pop ebx
pop edi
pop ebp
ret 8

Function at 0x100109f0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 8]
test edx, edx
je 0x10010a47
push esi
mov esi, dword [ebp + 8]
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
push edi
mov edi, dword [edx + 4]
mov edx, dword [edx]
dec edi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, edi
mov ecx, dword [edx + eax*8]
cmp ecx, esi
je 0x10010a3e
nop
test ecx, ecx
je 0x10010a45
inc eax
and eax, edi
mov ecx, dword [edx + eax*8]
cmp ecx, esi
jne 0x10010a30
mov dword [edx + eax*8], 0xffffffff
pop edi
pop esi
pop ebp
ret 4
Function at 0x10011170
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10027008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], esi
cmp dword [ebx + 0x24], esi
jne 0x100111ab
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
je 0x100111c0
mov eax, dword [ebx + 0x18]
add eax, edi
cmp eax, 0x20
jbe 0x100111d9
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001a301
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebx + 0x1c]
cmp edi, 1
ja 0x100111cf
mov edi, 1
jmp 0x100111d9
cmp edi, 4
jbe 0x100111d8
shr edi, 1
jmp 0x100111d9
dec edi
cmp ecx, 3
mov eax, 1
cmovl eax, ecx
mov dword [ebp - 0x14], eax
test edi, edi
je 0x100112e2
nop
lea eax, [ebp - 8]
push eax
push 4
push ebx
push 0x10011470
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100112d6
push 0x20
call fcn.1001a312
mov esi, eax
xorps xmm0, xmm0
add esp, 4
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x1001124c
mov eax, dword [ecx]
call dword [eax + 0xc]
test eax, eax
je 0x1001124c
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
jmp 0x10011265
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
mov ecx, dword [ebx + 8]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx + 0xc]
push esi
push dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 0x14]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100112cd
mov ecx, dword [ebx + 0x1c]
cmp ecx, 2
jbe 0x100112af
cmp eax, 1
je 0x100112b6
cmp ecx, 2
jb 0x100112cd
cmp eax, 2
jne 0x100112cd
mov eax, 2
shl eax, cl
sub eax, 2
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov dword [esi + 0xc], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub edi, 1
jne 0x100111f0
mov esi, dword [ebp - 0x10]
push esi
lea eax, [ebx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test esi, esi
je 0x100112fd
push 1
lea ecx, [ebx + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001a301
mov esp, ebp
pop ebp
ret 0x14