joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d5ad4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
xor edx, edx
push ebp
push 0x6d5b68
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006d571c
mov edi, eax
mov byte [edi + 0x48], bl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, esi
call fcn.00657700
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 0xc]
call fcn.00657700
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp + 8]
call fcn.00657700
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6d5b6f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx + 4]
pop eax
jmp eax

Function at 0x6d658c
Capabilities:
Open clipboard

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, eax
xor ebx, ebx
test ebx, ebx
jle 0x6d65a2
push ebp
call sub.kernel32.dll_Sleep
mov eax, dword [esi + 8]
push eax
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
inc ebx
test al, al
jne 0x6d65ba
cmp edi, ebx
jg 0x6d6598
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100c4940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10270480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x102b16e9
call fcn.10003b43
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100c497e
xor al, al
jmp 0x100c4ae2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x100c499c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x100c4a9d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x100c49b5
jmp 0x100c4994
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x100c49e6
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x100c49ed
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100c4a0d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100c4a19
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x100c4a54
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x100c4a32
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x100c4a3e
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x100c4a54
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x100c4a67
jmp 0x100c4994
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100026a3
nop
jmp 0x100c4994
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x100c4aba
mov dword [ebp - 0x40], 1
jmp 0x100c4ac1
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x100c4ad8
mov dword [ebp - 0x44], 1
jmp 0x100c4adf
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002207
mov esp, ebp
pop ebp
ret
Function at 0x100c53d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x102b16e9
call fcn.10003b43
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.100035c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x100c541a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x100c5439
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x100c5411
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100c5470
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100e3f30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10270480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x102b2399
call fcn.10003b43
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100e3f6e
xor al, al
jmp 0x100e40d2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x100e3f8c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x100e408d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x100e3fa5
jmp 0x100e3f84
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x100e3fd6
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x100e3fdd
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100e3ffd
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100e4009
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x100e4044
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x100e4022
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x100e402e
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x100e4044
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x100e4057
jmp 0x100e3f84
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100026a3
nop
jmp 0x100e3f84
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x100e40aa
mov dword [ebp - 0x40], 1
jmp 0x100e40b1
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x100e40c8
mov dword [ebp - 0x44], 1
jmp 0x100e40cf
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002207
mov esp, ebp
pop ebp
ret
Function at 0x100e49c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x102b2399
call fcn.10003b43
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.100035c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x100e4a0a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x100e4a29
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x100e4a01
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100e4a60
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10191560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10270480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x102b3cfa
call fcn.10003b43
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x1019159e
xor al, al
jmp 0x10191702
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x101915bc
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x101916bd
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x101915d5
jmp 0x101915b4
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x10191606
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x1019160d
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1019162d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10191639
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x10191674
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x10191652
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x1019165e
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x10191674
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x10191687
jmp 0x101915b4
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100026a3
nop
jmp 0x101915b4
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x101916da
mov dword [ebp - 0x40], 1
jmp 0x101916e1
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x101916f8
mov dword [ebp - 0x44], 1
jmp 0x101916ff
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002207
mov esp, ebp
pop ebp
ret
Function at 0x10191ff0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x102b3cfa
call fcn.10003b43
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.100035c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x1019203a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x10192059
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x10192031
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10192090
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x101d9040
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x10270480]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x102b582a
call fcn.10003b43
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x101d907e
xor al, al
jmp 0x101d91e2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0xc]
add edx, 0x14
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x101d909c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x2c]
je 0x101d919d
mov edx, dword [ebp - 0x1c]
sub edx, 8
mov dword [ebp - 0x24], edx
jne 0x101d90b5
jmp 0x101d9094
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x34], 0
je 0x101d90e6
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
jmp 0x101d90ed
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x101d910d
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x101d9119
mov byte [ebp - 0xe], 0
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xd], al
jmp 0x101d9154
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x20], edx
je 0x101d9132
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x4550
je 0x101d913e
mov byte [ebp - 0xf], 0
mov cl, byte [ebp - 0xf]
mov byte [ebp - 0xd], cl
jmp 0x101d9154
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov byte [ebp - 0x10], 1
mov cl, byte [ebp - 0x10]
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0xd]
mov byte [ebp - 0x11], dl
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x101d9167
jmp 0x101d9094
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x58], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100026a3
nop
jmp 0x101d9094
mov edx, dword [ebp + 8]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [eax + 4]
cmp edx, dword [ecx + 8]
jne 0x101d91ba
mov dword [ebp - 0x40], 1
jmp 0x101d91c1
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
mov byte [ebp - 0x12], al
movzx ecx, byte [ebp - 0x12]
test ecx, ecx
jne 0x101d91d8
mov dword [ebp - 0x44], 1
jmp 0x101d91df
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002207
mov esp, ebp
pop ebp
ret
Function at 0x101d9ad0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
mov ecx, 0x102b582a
call fcn.10003b43
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp + 0x10]
call fcn.100035c6
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x811c9dc5
mov dword [ebp - 4], 0
jmp 0x101d9b1a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jae 0x101d9b39
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
xor eax, dword [ebp - 8]
imul ecx, eax, 0x1000193
mov dword [ebp - 8], ecx
jmp 0x101d9b11
mov edx, dword [ebp - 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.101d9b70
add esp, 0xc
mov ecx, dword [ebp - 0xc]
or ecx, 1
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10210f60
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10270480]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x102110dc
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x102110c9
cmp dword [ebp - 0x28], 0x10
jb 0x102110ad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.10002da6
cmp dword [ebp - 0x1c], eax
jne 0x102110ad
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.10002da6
cmp dword [ebp - 0x20], eax
je 0x102110ad
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10211034
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x102aaf0c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.10002da6
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x10211032
jmp 0x102110c9
jmp 0x1021108d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1021108d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x102aaf0c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.10002da6
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x10211077
jmp 0x102110c9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10210fb3
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10002da6
push edx
mov ecx, ebp
push eax
lea edx, [0x10211108]
call fcn.100028ba
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10002207
add esp, 0x30
cmp ebp, esp
call fcn.10002da6
mov esp, ebp
pop ebp
ret
Function at 0x10211120
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10210f60
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x102111eb
mov dword [ebp - 4], 0
jmp 0x1021117c
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x102111eb
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10002da6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x102111e9
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.10002da6
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10210d80
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10002da6
jmp 0x10211173
pop esi
add esp, 8
cmp ebp, esp
call fcn.10002da6
mov esp, ebp
pop ebp
ret

Function at 0x10211200
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x102112ab
mov dword [ebp - 4], 0
jmp 0x10211233
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1021128e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10002da6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1021128c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.10002da6
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10002da6
jmp 0x1021122a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x102aaf0c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10002da6
pop esi
add esp, 8
cmp ebp, esp
call fcn.10002da6
mov esp, ebp
pop ebp
ret