joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ce52260
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
and edx, edx
je 0x7ce52385
push dword [edx + 2]
mov ecx, 0x7ce53070
call fcn.7ce52200
push dword [edx]
add ecx, 8
call fcn.7ce52200
push dword [edx + 4]
add ecx, 0xa
call fcn.7ce52200
push dword [edx + 6]
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 8]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xa]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xc]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
mov eax, dword [edx + 0xe]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
mov edx, dword [ebp + 0xc]
and edx, edx
je 0x7ce5233f
push dword [edx + 2]
mov ecx, 0x7ce530c8
call fcn.7ce52200
push dword [edx]
add ecx, 8
call fcn.7ce52200
push dword [edx + 4]
add ecx, 0xa
call fcn.7ce52200
push dword [edx + 6]
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 8]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xa]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xc]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
mov eax, dword [edx + 0xe]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7cd8c242
and eax, eax
jge 0x7ce52381
push eax
push section..sec6
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x7ce53070
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp + 0xc]
and edx, edx
je 0x7ce52380
push 0x7ce530c8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop eax
pop ebp
ret 0x14
push section..sec6
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
jmp fcn.7cd8c242

Function at 0x7ce523a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
and edx, edx
je 0x7ce52450
push dword [edx + 2]
mov ecx, 0x7ce53070
call fcn.7ce52200
push dword [edx]
add ecx, 8
call fcn.7ce52200
push dword [edx + 4]
add ecx, 0xa
call fcn.7ce52200
push dword [edx + 6]
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 8]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xa]
xchg ah, al
push eax
add ecx, 0xa
call fcn.7ce52200
mov eax, dword [edx + 0xc]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
mov eax, dword [edx + 0xe]
xchg ah, al
push eax
add ecx, 8
call fcn.7ce52200
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
call fcn.7cd8c281
and eax, eax
jge 0x7ce5244c
cmp dword [ebp + 0x18], 0
je 0x7ce5244c
push eax
push 0x7ce53034
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x7ce53070
nop
nop
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop eax
pop ebp
ret 0x18
push 0x7ce53034
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop ebp
jmp fcn.7cd8c281
Function at 0x414ddb
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], edi
add eax, ecx
add ebx, 1
add edx, 4
and eax, ecx
mov ebx, 0x581ce3ca
or eax, ecx
cmp edx, esi
jne fcn.00414ddb
mov eax, ecx
ret
Function at 0x805f58
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805f5e
pop ebp
sub ebp, 6
sub ebp, 0x405f58
jmp 0x805fbc
jmp 0x805fc5
mov eax, 0x405f58
add eax, ebp
add eax, 0x93
mov ecx, 0x61d
mov edx, 0x2097459
xor byte [eax], dl
inc eax
dec ecx
jne 0x805fdc
jmp 0x805fef
xor ebx, dword [ecx]
xor dword [ecx + 0x49], ebx
pop ecx
pop ecx
xor dword [ecx - 0x6b], ebx
jne 0x806054
push 0xffffffffffffff99
or dword [esi + 0x6f8859cc], esp
pop ecx
or edx, edx
xchg esp, eax
rcl al, cl
pop ecx
pop ecx
pop ecx
fcomp dword [eax + 0x595959a1]
pop edx
xchg esp, eax
loope 0x806076
pop ecx
pop ecx
pop ecx
jecxz 0x80608d
pop ecx
pop ecx
pop ecx
scasb al, byte es:[edi]
mov ebx, 0xd8d2915a
push ebp
pop ecx
pop ecx
pop ecx
pop edx
pushfd
or dword [ecx], esi
cmc
outsb dx, byte [esi]
push eax
pop ecx
xor edx, esi
jle 0x8060a3
pop ecx
pop eax
jne 0x8060b6
xor dword [ecx + 0x59], ebx
pop ecx
pop ecx
mov cl, 0x5c
pop ecx
pop ecx
pop ecx
mov al, 0x73
pop ecx
pop ecx
pop ecx
or al, 0xd4
xor eax, 0xdcd2597d
push ecx
pop ecx
pop ecx
pop ecx
ror ah, cl
push ebp
pop ecx
pop ecx
pop ecx
rcl ah, cl
dec ecx
pop ecx
pop ecx
pop ecx
cwde
mov al, 0x5b
push 0x5d9bda5b
adc byte [esi - 0x24], dl
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
add al, 0x9b
push ebp
pop ecx
rcl ch, cl
jge 0x8060d3
int3
pop ecx
pop ecx
pop ecx
xor ebp, esi
outsb dx, byte [esi]
push eax
pop ecx
xor edx, esi
jle 0x8060f0
pop ecx
pop eax
jne 0x806103
or byte [ecx + 0x5959595c], dh
mov al, 0x6c
insb byte es:[edi], dx
pop ebx
pop ecx
pop ecx
or al, 0xd4
xor eax, 0x2ca6597d
push ebp
cmpsb byte [esi], byte es:[edi]
sub al, 0x51
mov cl, 0x3f
pop ecx
pop ecx
pop ecx
shl ah, cl
push ecx
pop ecx
pop ecx
pop ecx
push 0xffffffffffffff90
push 0xffffffffffffff8b
fidiv dword [ecx - 0x22a9eea4]
pop ss
pop ecx
pop ecx
pop ecx
push esi
rcl dword [ecx]
pop ecx
pop ecx
pop ecx
aas
rol byte [ebp + 0x60], cl
fldenv [edx + 0x43dd56b1]
pop ecx
pop ecx
pop ecx
fldenv [edx + 0x48dd56b0]
pop ecx
pop ecx
pop ecx
aas
fsub dword [edx - 0x22a9835a]
mov byte [0xdd567ca6], al
dec esp
pop ecx
pop ecx
pop ecx
sbb byte [eax - 0x5959596b], dh
jo 0x8060f9
pushal
pop eax
ficomp dword [eax + 0x5db1da5c]
mov al, 0xe4
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
jo 0x806100
pushal
pop ebx
ficomp dword [eax + 0x5db3da5f]
mov bl, 0x5d
fidiv dword [ecx - 0x590d4fa4]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
add al, 0x9b
push ebp
pop ecx
or al, 0xd2
mov ch, 0xf
push cs
or al, 0xd2
sub al, 0x55
shl byte [ecx + edx*2], cl
movsd dword es:[edi], dword [esi]
jmp 0x8060ef
Function at 0x100063d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, ecx
xor edx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
mov edx, dword [esi + 0x20]
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x34]
and ecx, eax
mov eax, dword [esi + 0x28]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
cmp eax, edx
je 0x10006442
mov ecx, dword [ecx]
cmp ebx, dword [eax + 8]
je 0x10006444
cmp eax, ecx
je 0x10006442
mov eax, dword [eax + 4]
cmp ebx, dword [eax + 8]
jne 0x10006434
jmp 0x10006444
xor eax, eax
pop esi
pop ebx
test eax, eax
je 0x10006455
cmp eax, edx
je 0x10006455
mov eax, dword [eax + 0xc]
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x10008f50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100090a6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1009284a
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10009009
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10008fc7
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000909c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1000901d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10009020
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000909c
lea ebx, [ebx]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1009284a
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x100090ad
cmp esi, eax
jne 0x10009077
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10009030
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100091d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b5485
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x100e3274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
mov dword [ebp - 0x20], ebx
call fcn.10009550
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10009252
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
jmp 0x10009398
cmp dword [esi + 8], 0xfffffff
je 0x100093ae
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x28], 0
call fcn.10092500
mov dword [ebp - 0x28], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x1c], ecx
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
fld dword [esi]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jns 0x100092b1
fadd dword [0x100dafd0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov edi, dword [esi + 0x1c]
fild dword [esi + 0x1c]
test edi, edi
jns 0x100092c7
fadd dword [0x100dafd0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x10009349
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.100a7e60
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
add esp, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
fldcw word [ebp + 0xe]
cmp eax, 8
ja 0x10009319
mov eax, 8
cmp edi, eax
jae 0x1000932e
cmp edi, 0x200
jae 0x1000932c
shl edi, 3
cmp edi, eax
jae 0x1000932e
mov edi, eax
push edi
mov ecx, esi
call fcn.100093e0
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.10009550
mov edi, dword [eax]
jmp 0x10009350
mov edi, dword [ebp - 0x18]
fstp st(0)
fstp st(0)
mov ecx, dword [ebp - 0x28]
mov ebx, dword [edi + 4]
inc dword [esi + 8]
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ebx], ecx
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x18]
and eax, dword [ebp - 0x20]
mov edx, dword [esi + 0xc]
mov ecx, dword [ebp - 0x24]
mov esi, dword [edx + eax*8]
cmp esi, dword [ecx]
mov ecx, dword [ebp - 0x28]
jne 0x1000937e
mov dword [edx + eax*8], ecx
jmp 0x1000938d
cmp esi, edi
jne 0x10009387
mov dword [edx + eax*8], ecx
jmp 0x10009391
cmp dword [edx + eax*8 + 4], ebx
jne 0x10009391
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp + 8]
mov byte [eax + 4], 1
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100944c0
int3
Function at 0x100093e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1000953a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100090e0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1000950d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10009493
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10009503
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100094cd
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x100094c5
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10009500
cmp edi, edx
je 0x100094dd
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10009516
cmp edi, edx
jne 0x100094d1
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10009442
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10009500
push str.invalid_hash_bucket_count
call fcn.100944c0
int3
Function at 0x1000ab70
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100e9065], 0
push esi
mov esi, edx
je 0x1000aba8
fld dword [esi + 0x40]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fldz
fucomp st(1)
fnstsw ax
test ah, 0x44
jnp 0x1000aba6
fld1
fucompp
fnstsw ax
test ah, 0x44
jnp 0x1000aba8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
fstp st(0)
cmp dword [ecx + 0x44], 3
jne 0x1000ab9f
push ecx
call dword [0x100e9360]
add esp, 4
test eax, eax
je 0x1000ab9f
mov ecx, dword [esi + 0x2c]
cmp ecx, dword [eax + 0xa4]
jge 0x1000ab9f
imul ecx, ecx, 0xb0
add ecx, dword [eax + 0xa8]
mov ecx, dword [ecx + eax + 0x28]
cmp ecx, 0x24
je 0x1000ac29
cmp ecx, 0x25
je 0x1000ac29
cmp ecx, 0x26
je 0x1000ac29
cmp ecx, 0x27
je 0x1000ac29
cmp ecx, 0x42
je 0x1000ac29
cmp ecx, 0x43
je 0x1000ac29
cmp ecx, 0x44
je 0x1000ac29
cmp ecx, 0x45
je 0x1000ac29
cmp ecx, 0x28
je 0x1000ac1f
cmp ecx, 0x29
je 0x1000ac1f
cmp ecx, 0x2a
je 0x1000ac1f
xor eax, eax
cmp ecx, 0x2b
pop esi
setne al
dec eax
and eax, 2
mov esp, ebp
pop ebp
ret
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000cbe0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [0x100e90e0], 0
push ebx
push esi
push edi
jne 0x1000cdc8
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 4]
ja 0x1000cdc8
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebx
push eax
lea ecx, [edi + 0xc]
call fcn.1000e100
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x1000cc39
cmp ebx, dword [eax + 0x10]
jb 0x1000cc39
cmp eax, dword [edi + 0xc]
jne 0x1000cdc8
lea eax, [ebp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.1000dd90
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0x24c
jne 0x1000ccbd
mov ecx, dword [ebx + 0xe4]
cmp byte [ecx + 0x90], 1
jne 0x1000ccbd
cmp dword [ecx + 0x98], 2
jne 0x1000ccbd
mov ecx, dword [ecx + 0xa0]
mov edx, dword [0x100e9508]
cmp ecx, edx
jbe 0x1000ccbd
mov eax, dword [0x100e9518]
add eax, edx
cmp ecx, eax
jae 0x1000ccbd
mov edx, str.Too_many_attachments_on__s_n
mov esi, 0x17
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000ccbd
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000cc92
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x1000ccbd
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000ccbd
mov eax, dword [edi + 0x28]
mov dword [0x100e90c0], eax
jmp 0x1000ccc2
mov eax, dword [0x100e90c0]
test eax, eax
jne 0x1000cdc8
mov eax, dword [ebx]
cmp eax, 0x108
je 0x1000cceb
mov ecx, eax
cmp eax, 0xfd
jb 0x1000cdac
cmp eax, 0x110
ja 0x1000cdac
mov edx, dword [ebx + 0xe4]
mov ecx, eax
cmp byte [edx + 0x90], 1
jne 0x1000cdac
cmp dword [edx + 0x98], 2
jne 0x1000cdac
mov eax, dword [edx + 0xa0]
lea ecx, [edi + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000e100
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x1000cd45
mov ecx, dword [esp + 0x10]
cmp ecx, dword [eax + 0x10]
jb 0x1000cd45
cmp eax, dword [edi + 0x14]
jne 0x1000cda2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x14]
call fcn.1000de70
mov edx, dword [ebp + 0x18]
inc edx
cmp edx, dword [edi + 8]
jge 0x1000cda2
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x300
cmp ecx, dword [edi + 0x24]
je 0x1000cd8a
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 0x300
mov dword [ecx + 8], edx
add dword [edi + 0x20], 0xc
jmp 0x1000cda2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
lea ecx, [edi + 0x1c]
call fcn.1000df40
mov ecx, dword [ebx]
cmp ecx, 0x108
je 0x1000cdc8
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0xcc
je 0x1000cdc8
xor eax, eax
cmp ecx, 0x93
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000ed10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b55d2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100e3274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0xffffffff
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0x2060]
mov dword [ebp - 0x14], esi
fldz
fstp dword [esi]
push 0x24
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10092500
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 6
mov ebx, eax
fld1
fstp dword [esi]
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov ecx, dword [esi + 0x10]
mov eax, ecx
sar eax, 2
cmp eax, 0x10
jae 0x1000ee8e
push 0x40
call fcn.10092500
mov ecx, dword [edi + 0x2074]
mov esi, eax
mov eax, dword [edi + 0x206c]
add esp, 4
sub ecx, eax
sar ecx, 2
test ecx, ecx
je 0x1000ee6a
shl ecx, 2
cmp ecx, 0x1000
jb 0x1000ee60
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000efb5
mov eax, edx
push ecx
push eax
call fcn.1009284a
add esp, 8
lea eax, [esi + 0x40]
mov dword [edi + 0x206c], esi
mov dword [edi + 0x2070], eax
mov dword [edi + 0x2074], eax
cmp esi, eax
je 0x1000ee9d
mov dword [esi], ebx
add esi, 4
cmp esi, eax
jne 0x1000ee83
jmp 0x1000ee9d
xor eax, eax
cmp eax, ecx
je 0x1000ee9d
mov dword [eax], ebx
add eax, 4
cmp eax, ecx
jne 0x1000ee94
mov dword [edi + 0x2080], 0
mov eax, edi
mov dword [edi + 0x2084], 0
mov dword [edi + 0x2088], 0
mov dword [edi + 0x208c], 0
mov dword [edi + 0x2090], 0
mov dword [edi + 0x2094], 0
mov dword [edi + 0x2098], 0
mov dword [edi + 0x209c], 0
mov dword [edi + 0x20a0], 0
mov dword [edi + 0x20a4], 0
mov dword [edi + 0x20a8], 0
mov dword [edi + 0x20ac], 0
mov dword [edi + 0x20b0], 0
mov dword [edi + 0x20b4], 0
mov dword [edi + 0x20b8], 0
mov dword [edi + 0x20bc], 0
mov dword [edi + 0x20c0], 0
mov dword [edi + 0x20c4], 0
fldz
fst dword [edi + 0x10]
fst dword [edi + 0x14]
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0xc], 0xffffffff
fst dword [edi + 0x20c8]
fst dword [edi + 0x20cc]
fst dword [edi + 0x20d0]
fst dword [edi + 0x20d4]
fstp dword [edi + 0x20d8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10096f8f
int3
Function at 0x1000ff40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5397829d
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xb94]
sub ecx, dword [0x100e9078]
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
js 0x1001001a
mov eax, dword [0x100e9090]
cmp ecx, dword [eax]
jge 0x1001001a
mov eax, dword [0x100e9688]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1001001a
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e965c
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.10009550
mov ecx, dword [0x100e9660]
mov eax, dword [eax + 4]
test eax, eax
jne 0x1000ffdc
mov eax, ecx
cmp eax, ecx
jne 0x1001002f
cmp esi, dword [0x100e9118]
je 0x1000fffe
mov eax, dword [esi + 0x308]
cmp eax, 7
je 0x1000fff8
cmp eax, 0xd
jne 0x1000fffe
mov byte [ebp + 8], 1
jmp 0x10010002
mov byte [ebp + 8], 0
push dword [ebp + 8]
push edi
push dword [0x100e9694]
push esi
call fcn.1000fbf0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x100e9524]
push str.CreateBrushModel:_Invalid_model_index_n
mov eax, dword [eax + 0x98]
call eax
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4