joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046d70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
mov esi, dword [edx + 0xc]
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 4]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea ecx, [ecx*8 + 4]
add ecx, esi
mov esi, eax
mov dword [ebp - 0xc], ecx
nop dword [eax]
cmp esi, edx
jne 0x10046de8
mov ecx, edx
jmp 0x10046dec
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10046e02
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x10046dfe
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
jmp 0x10046de0
mov dword [edi], eax
jmp 0x10046e04
mov dword [edi], edx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009999a
mov esp, ebp
pop ebp
ret 8

Function at 0x10046e30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x10046eb6
cmp eax, edi
jne 0x10046eae
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10046ebe
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10046ebe
cmp eax, edi
jne 0x10046ec1
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x50]
dec dword [ebx + 8]
call fcn.10046b10
push 0x5c
push edi
call fcn.10099e4f
mov eax, dword [ebp - 8]
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.1009999a
mov esp, ebp
pop ebp
ret 8
Function at 0x10049c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x100f03c8]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp dword [eax + 0x14], 0x10
mov esi, eax
push edi
mov edi, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
jb 0x10049c92
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10049cb1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10049ca0
cmp dword [ebx + 4], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 0
jle 0x10049dc7
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, dword [ebx]
add ebx, ecx
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x10049cf7
cmp dword [ecx + 4], 0
jle 0x10049cf7
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp + 0x10]
push eax
push ecx
push dword [esp + 0x1c]
mov ecx, 0x10122a58
call fcn.10049c60
mov esi, dword [ebx]
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x10049d00
xor edx, edx
test eax, eax
je 0x10049d21
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10049d10
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
mov ecx, 0x10122a78
call fcn.1003b5f0
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.1003b6d0
cmp dword [eax + 8], 0
jne 0x10049da6
lea eax, [esp + 0x1c]
mov ecx, 0x10122a78
push eax
call fcn.1003b5f0
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov ecx, 0x10122a78
mov byte [eax], 0
lea eax, [esp + 0x1c]
push eax
call fcn.1003b5f0
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov ecx, 0x10122a78
mov dword [eax + 4], ebx
lea eax, [esp + 0x1c]
mov esi, dword [ebx + 0x2c]
add esi, dword [ebp + 0x10]
push eax
call fcn.1003b5f0
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov dword [eax + 8], esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x18]
inc eax
mov ecx, dword [esp + 0x10]
add ecx, 0x3c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp eax, dword [ebx + 4]
jl 0x10049cd0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1009999a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004a010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
test eax, eax
je 0x1004a034
mov ebx, dword [eax + 2]
test ebx, ebx
je 0x1004a034
add ebx, 0xfffffffc
jmp 0x1004a036
xor ebx, ebx
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x1004a17f
mov eax, dword [ebx + 4]
test eax, eax
je 0x1004a17f
cmp eax, 0xc8
jg 0x1004a17f
cmp dword [ebx], 0
je 0x1004a17f
push esi
mov esi, dword [ebx + 8]
test esi, esi
je 0x1004a17e
push edi
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x1004a074
xor edx, edx
test ecx, ecx
je 0x1004a092
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1004a081
mov dword [ebp - 8], edi
cmp dword [ebx + 4], 0
mov dword [ebp - 0x14], 0
jle 0x1004a17d
xor eax, eax
mov dword [ebp - 0x10], eax
nop dword [eax + eax]
mov ebx, dword [ebx]
add ebx, eax
mov esi, dword [ebx + 4]
test esi, esi
je 0x1004a164
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1004a0c6
xor edx, edx
test eax, eax
je 0x1004a0e4
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x1004a0d3
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
mov ecx, 0x10122a78
call fcn.1003b5f0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1003b6d0
cmp dword [eax + 8], 0
jne 0x1004a161
lea eax, [ebp - 8]
mov ecx, 0x10122a78
push eax
call fcn.1003b5f0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov ecx, 0x10122a78
mov byte [eax], 1
lea eax, [ebp - 8]
mov esi, dword [ebx + 8]
push eax
call fcn.1003b5f0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov ecx, 0x10122a78
mov dword [eax + 8], esi
lea eax, [ebp - 8]
push eax
call fcn.1003b5f0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1003b6d0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
add eax, 0x3c
mov ebx, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebx + 4]
jl 0x1004a0b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1009999a
mov esp, ebp
pop ebp
ret 4
Function at 0x1006bae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c95f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x30], 0
mov ebx, 0xf
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x1006bbd9
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1006bb5e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1006bb49
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1001fe30
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1006bb77
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x1006bb84
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10025410
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x1006bbb4
nop
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x1006bba0
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x1006bbc4
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1006bbd4
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x1006bbdc
mov ebx, dword [ebp - 0x14]
jmp 0x1006bb35
mov esi, dword [esi + 0x18]
jmp 0x1006bbde
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1006bc11
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x1006bc07
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1006bc31
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.10099e4f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009999a
mov esp, ebp
pop ebp
ret 0xc
call fcn.100a1274
int3
Function at 0x1006bc40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c95f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x30], 1
mov ebx, 0xf
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x1006bd39
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1006bcbe
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1006bca9
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1001fe30
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1006bcd7
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x1006bce4
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10025410
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x1006bd14
nop
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x1006bd00
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x1006bd24
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x1006bd34
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x1006bd3c
mov ebx, dword [ebp - 0x14]
jmp 0x1006bc95
mov esi, dword [esi + 0x18]
jmp 0x1006bd3e
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1006bd71
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x1006bd67
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1006bd91
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.10099e4f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009999a
mov esp, ebp
pop ebp
ret 0xc
call fcn.100a1274
int3
Function at 0x10078540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c9c3e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100f03c8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x10078743
cmp dword [0x10122288], 0
je 0x10078743
mov edi, dword [eax + 8]
mov eax, dword [0x10122b00]
test al, 1
jne 0x100785e3
or eax, 1
mov dword [0x10122b00], eax
mov edx, 0x990704d7
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.1003cc70
push 0xda7d68cb
mov edx, eax
mov ecx, 0x10122b04
call fcn.1003d070
add esp, 4
push 0x100cb5d0
call fcn.10099e3a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x10122b04]
call eax
mov esi, eax
mov dword [ebp - 0x18], esi
test edi, edi
je 0x10078660
test esi, esi
je 0x10078660
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x10078660
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov eax, dword [ecx]
mov ecx, esi
and eax, 0xffffff
push eax
call edx
mov esi, eax
test esi, esi
je 0x10078649
mov edi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [ecx + esi], 0
jne 0x10078620
xor edx, edx
test ecx, ecx
je 0x10078649
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10078630
cmp edi, 0x11ab48ff
je 0x1007865b
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x14]
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x10078660
mov esi, dword [ebp - 0x18]
jmp 0x10078601
mov ecx, dword [ebp - 0x14]
jmp 0x10078662
xor ecx, ecx
movsx eax, byte [ecx + 0x10]
dec eax
cmp eax, 6
ja case.0x1007866c.2
jmp dword [eax*4 + 0x1007875c]
push dword [ecx + 4]
call fcn.100ab3e5
add esp, 4
mov edx, eax
jmp 0x100786a8
push dword [ecx + 8]
call fcn.100ab3a6
add esp, 4
mov edx, eax
jmp 0x100786a8
movss xmm0, dword [ecx + 0xc]
call fcn.10017fb0
cvttss2si edx, xmm0
jmp 0x100786a8
xor edx, edx
jmp 0x100786a8
mov edx, dword [ecx + 0xc]
mov ecx, dword [0x1011c418]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
mov ecx, dword [0x1011c418]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
call edx
cmp esi, eax
jne 0x10078743
mov ecx, dword [0x101193cc]
xor edx, edx
mov esi, dword [0x101193d0]
movss xmm1, dword [0x100e0cc0]
add esi, ecx
mov dword [ebp - 0x14], esi
cmp ecx, esi
je 0x10078743
mov edi, dword [0x101193c8]
movss xmm2, dword [0x100e0d50]
nop word [eax + eax]
mov esi, dword [0x101193c4]
lea eax, [edi - 1]
and eax, ecx
mov eax, dword [esi + eax*4]
mov esi, dword [ebp - 0x14]
cmp byte [eax + 0x3c], 0
jne 0x10078736
mov esi, dword [0x1011c474]
movss xmm0, dword [esi]
subss xmm0, dword [eax + 8]
mov esi, dword [ebp - 0x14]
andps xmm0, xmm2
comiss xmm1, xmm0
jb 0x10078736
movaps xmm1, xmm0
mov edx, eax
inc ecx
cmp ecx, esi
jne 0x10078700
test edx, edx
je 0x10078743
mov byte [edx + 0x3c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1008f7a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, dword [ebp + 8]
xor ecx, eax
mov dword [ebp - 4], esi
imul ecx, ecx, 0x1000193
mov eax, ebx
sar eax, 0x10
movzx eax, al
push edi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x10122254]
and edx, dword [0x10122260]
mov edi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x1012224c]
add ecx, 4
mov eax, edi
mov dword [ebp - 4], ecx
nop
cmp edi, edx
jne 0x1008f818
mov ecx, edx
jmp 0x1008f81c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1008f838
cmp dword [eax + 8], ebx
je 0x1008f82c
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x1008f810
cmp eax, edx
je 0x1008f838
push 1
add eax, 0xc
push eax
jmp 0x1008f83f
push 0
push 0x100da104
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
call fcn.1001fe30
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100962a0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100f03c8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x1009641c
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10096409
cmp dword [ebp - 0x28], 0x10
jb 0x100963ed
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.1009a48f
cmp dword [ebp - 0x1c], eax
jne 0x100963ed
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.1009a48f
cmp dword [ebp - 0x20], eax
je 0x100963ed
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10096374
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x1011a374]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.1009a48f
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10096372
jmp 0x10096409
jmp 0x100963cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100963cd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1011a374]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.1009a48f
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100963b7
jmp 0x10096409
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100962f3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009a48f
push edx
mov ecx, ebp
push eax
lea edx, [0x10096448]
call fcn.1009a43b
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009999a
add esp, 0x30
cmp ebp, esp
call fcn.1009a48f
mov esp, ebp
pop ebp
ret
Function at 0x10096460
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100962a0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x1009652b
mov dword [ebp - 4], 0
jmp 0x100964bc
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x1009652b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009a48f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10096529
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1009a48f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100960c0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009a48f
jmp 0x100964b3
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a48f
mov esp, ebp
pop ebp
ret

Function at 0x10096540
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100965eb
mov dword [ebp - 4], 0
jmp 0x10096573
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100965ce
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1009a48f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100965cc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1009a48f
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1009a48f
jmp 0x1009656a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1011a374]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1009a48f
pop esi
add esp, 8
cmp ebp, esp
call fcn.1009a48f
mov esp, ebp
pop ebp
ret