joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060266
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100602fc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1006029a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe6
jge 0x100602fa
mov dword [ebp - 0x38], 0x65653d42
mov dword [ebp - 0x34], 0x65653d42
mov dword [ebp - 0x30], 0x65653d42
mov dword [ebp - 0x2c], 0x65653d42
mov dword [ebp - 0xc], 0xbfc88eb9
mov dword [ebp - 0xc], 3
jmp 0x100602d5
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x100602f8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100602f6
push 0
push 0xd0f
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x100602ce
jmp 0x1006028f
jmp 0x10060337
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub eax, 4
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10066406
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10066448
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10066443
push 0
push 0
push 0
push 0
push 0
push 0
push 0x2582
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100664e6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x307b5ca9
jle 0x10066474
mov dword [ebp - 0x24], 1
jmp 0x10066478
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x39f7747
cmp eax, 0xe3cf9575
jbe 0x100664aa
mov dword [ebp - 8], 1
jmp 0x100664ae
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100664d1
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x100664d1
and dword [ebp - 0xc], 0
jmp 0x100664d8
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x100664ea
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10066566
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
push dword [eax]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
push 0x28d9
mov eax, dword [ebp - 0x2c]
push dword [eax]
push 0x6f52
push 0
push 0x1ac6
call fcn.10067a72
add esp, 0x24
jmp 0x1006657c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1006657c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1006e2e9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x10]
push eax
push 0x6025
lea eax, [ebp + 8]
push eax
push 0x2f5b
call fcn.1006e0e7
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1006e323
xor eax, eax
jmp 0x1006e444
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1006e341
xor eax, eax
jmp 0x1006e444
push 0x4dd
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.1006e168
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1006e365
xor eax, eax
jmp 0x1006e444
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0x473b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1006e1d3
add esp, 0x1c
push dword [ebp + 8]
push dword [ebp - 4]
push 0
push dword [ebp - 8]
push 0x6df3
call fcn.1006b700
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1006e3bd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1006e270
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.1006c744
pop ecx
test eax, eax
jne 0x1006e3ce
xor eax, eax
jmp 0x1006e444
lea eax, [ebp - 4]
push eax
push 0x55e2
push 0
call fcn.1006e2a3
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1006e42c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1006e400
xor eax, eax
jmp 0x1006e444
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1006e419
xor eax, eax
jmp 0x1006e444
push 0x7fc6
lea eax, [ebp - 4]
push eax
push 1
call fcn.1006e2a3
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1006e43d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1006e441
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10074429
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x101434f0
call fcn.1013e250
sub esp, 0x48
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov esi, edx
mov dword [ebp - 0x20], edi
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [ebp - 0x1c], 1
mov ebx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x75006301
mov dword [ebp - 0x34], 0x92f9240a
mov dword [ebp - 0x30], 0xe062152d
mov word [ebp - 0x2c], 0x4be5
cmp ecx, 4
jne 0x10074486
push 0xa
pop ebx
push 0xc
pop ecx
jmp 0x100744b0
movzx eax, byte [ebp + ecx - 0x37]
lea edx, [ebx - 1]
sub eax, ecx
add edx, eax
jns 0x100744a6
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x38]
mov word [ebp + eax*2 - 0x28], dx
add ecx, 2
cmp ecx, 0xe
jb 0x10074479
xor eax, eax
lea ecx, [ebp - 0x50]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x28]
push eax
call fcn.10013e17
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x50]
xor ebx, ebx
cmp dword [ebp - 0x3c], 8
mov dword [ebp - 0x28], ebx
cmovae ecx, dword [ebp - 0x50]
cmp dword [esi + 0x14], 8
mov word [ebp - 0x24], bx
jb 0x100744ef
mov eax, dword [esi]
jmp 0x100744f1
mov eax, esi
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10122905
mov ecx, eax
add esp, 0xc
cmp ecx, 0xd
jne 0x1007452e
cmp dword [ebp - 0x3c], 8
lea eax, [ebp - 0x50]
cmovae eax, dword [ebp - 0x50]
cmp dword [esi + 0x14], 8
jb 0x10074519
mov esi, dword [esi]
push eax
push esi
call fcn.101228f0
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
test eax, eax
sete cl
jmp 0x10074531
mov eax, dword [ebp - 0x18]
test ecx, ecx
jne 0x100745a5
test eax, eax
je 0x100745a5
push 2
push ebx
push eax
call fcn.10123d1e
push dword [ebp - 0x18]
call fcn.10123c23
push ebx
push ebx
push dword [ebp - 0x18]
mov esi, eax
call fcn.10123d1e
add esp, 0x1c
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x11]
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
push eax
lea eax, [esi + 1]
push eax
call fcn.1003b4d2
mov byte [ebp - 4], 2
push dword [ebp - 0x18]
push esi
push 1
push dword [ebp - 0x38]
call fcn.1012358d
push dword [ebp - 0x18]
call fcn.10123e0d
add esp, 0x14
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.1004d19f
lea ecx, [ebp - 0x38]
call fcn.100146c8
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.10014448
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007ccef
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
test cl, cl
je 0x1007cd0b
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1007cd1a
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1007cd1a
mov eax, dword [edx]
test eax, eax
jns 0x1007cd1a
add eax, 0x100
js 0x1007cd11
mov dword [edx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1008173c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x10081756
mov eax, dword [edx]
test eax, eax
jns 0x1008176d
add eax, 0x100
js 0x1008174b
mov dword [edx], eax
pop ebp
ret
cmp byte [ecx], 0
je 0x1008176d
xor eax, eax
push eax
push 0x1f2
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
pop ebp
ret
Function at 0x100855b4
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x100855c5
mov ecx, edx
pop ebp
jmp fcn.1006ef54
mov eax, dword [ecx]
test eax, eax
jns 0x100855d4
add eax, 0x100
js 0x100855cb
mov dword [ecx], eax
pop ebp
ret

Function at 0x10085c69
Capabilities:
Compare security identifiers
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x10085c78
mov eax, dword [ebp + 8]
add dword [eax], 0xb
pop ebp
ret
pop ebp
jmp fcn.1006ef54
Function at 0x1008bf14
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
or edi, 0xffffffff
cmp dword [ecx + 0x14], 0x10
jb 0x1008bf28
mov esi, dword [ecx]
jmp 0x1008bf2a
mov esi, ecx
cmp dword [ecx + 0x14], 0x10
jb 0x1008bf34
mov edx, dword [ecx]
jmp 0x1008bf36
mov edx, ecx
mov eax, dword [ecx + 0x10]
xor ecx, ecx
and dword [ebp - 4], 0
add eax, edx
mov ebx, eax
sub ebx, esi
cmp esi, eax
cmova ebx, ecx
test ebx, ebx
je 0x1008bf7c
movsx edx, byte [esi]
mov ecx, edi
call fcn.1007bf0e
and eax, 0xff
shr edi, 8
mov ecx, edi
mov edx, dword [eax*4 + 0x1000a160]
call fcn.1007bf0e
mov edi, eax
inc esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1008bf4e
not edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1008db0f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1008dafe
Function at 0x100ad773
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
push edi
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100ad911
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100ad911
cmp eax, 0x29
jne 0x100ad7ae
cmp dword [esi + 0x10], 0
jne 0x100ad911
test dword [esi + 0x50], edx
je 0x100ad917
cmp eax, 0x2e
jne 0x100ad7c9
push 5
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov ecx, esi
call fcn.100ad74a
jmp 0x100ad8f9
cmp eax, 0x5c
jne 0x100ad824
mov ecx, esi
call fcn.100ad74a
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x100ad7fb
cmp byte [esi + 0x48], 0x62
jne 0x100ad7fb
push 4
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov ecx, esi
call fcn.100ad74a
jmp 0x100ad900
test eax, eax
je 0x100ad818
cmp byte [esi + 0x48], 0x42
jne 0x100ad818
push 4
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100ad7ef
mov ecx, esi
call fcn.100ae479
jmp 0x100ad8f9
cmp eax, 0x5b
jne 0x100ad884
mov ecx, esi
call fcn.100ad74a
lea ecx, [esi + 0x24]
call fcn.100aeb9b
cmp dword [esi + 0x4c], 0x5e
jne 0x100ad84c
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100ad74a
test dword [esi + 0x50], 0x20000000
je 0x100ad86c
cmp dword [esi + 0x4c], 0x5d
jne 0x100ad86c
push 0x5d
lea ecx, [esi + 0x24]
call fcn.100aebe5
mov ecx, esi
call fcn.100ad74a
mov ecx, esi
call fcn.100ae975
cmp dword [esi + 0x4c], 0x5d
je 0x100ad7bd
push 4
jmp 0x100ad919
cmp eax, 0x28
jne 0x100ad8a1
mov ecx, esi
call fcn.100ad74a
mov ecx, esi
call fcn.100ae555
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x100ad8ee
jmp 0x100ad917
cmp eax, 0x5e
jne 0x100ad8ad
push 2
jmp 0x100ad7e7
cmp eax, 0x24
jne 0x100ad8b9
push 3
jmp 0x100ad7e7
cmp eax, 0x2a
je 0x100ad90d
cmp eax, 0x2b
je 0x100ad90d
cmp eax, 0x3f
je 0x100ad90d
cmp eax, 0x7b
je 0x100ad90d
cmp eax, 0x7d
jne 0x100ad8d7
test dword [esi + 0x50], edx
je 0x100ad909
cmp eax, 0x5d
jne 0x100ad8e1
test dword [esi + 0x50], edx
je 0x100ad87d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100ae6c9
mov ecx, esi
call fcn.100ad74a
test bl, bl
je 0x100ad900
mov ecx, esi
call fcn.100ae605
mov cl, 1
mov bl, cl
jmp 0x100ad77c
push 6
jmp 0x100ad919
push 0xa
jmp 0x100ad919
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.1010b07b
int3
Function at 0x100d384e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
test cl, cl
je 0x100d386a
cmp byte [ebp - 1], 0
je 0x100d3889
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100d3889
cmp byte [ebp - 1], 0
je 0x100d3889
push 0x1e34
push 0x53e
push 1
push 0
push 0x2645
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov esp, ebp
pop ebp
ret
Function at 0x100d6115
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file attributes
Get file size
Get graphical window text
Get keyboard layout
Get session user name
Get system information on windows
Identify system language via api
Query or enumerate registry key
Read .ini file
Resume thread
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x100d6128
pop esi
pop ebp
jmp section..Pimcj
mov dword [edx], 0
jmp 0x100d613d
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edx]
cmp dword [edx], 1
jl 0x100d6130
pop esi
pop ebp
ret
Function at 0x100e00fe
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, 1
push edi
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100e029e
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100e029e
cmp eax, 0x29
jne 0x100e0139
cmp dword [esi + 0x10], 0
jne 0x100e029e
test dword [esi + 0x50], edx
je 0x100e02a4
cmp eax, 0x2e
jne 0x100e0154
push 5
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov ecx, esi
call fcn.100e00d3
jmp 0x100e0286
cmp eax, 0x5c
jne 0x100e01b1
mov ecx, esi
call fcn.100e00d3
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x100e0187
cmp word [esi + 0x48], 0x62
jne 0x100e0187
push 4
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov ecx, esi
call fcn.100e00d3
jmp 0x100e028d
test eax, eax
je 0x100e01a5
cmp word [esi + 0x48], 0x42
jne 0x100e01a5
push 4
lea ecx, [esi + 0x24]
call fcn.100ad9fc
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100e017b
mov ecx, esi
call fcn.100e0a07
jmp 0x100e0286
cmp eax, 0x5b
jne 0x100e0211
mov ecx, esi
call fcn.100e00d3
lea ecx, [esi + 0x24]
call fcn.100e12ca
cmp dword [esi + 0x4c], 0x5e
jne 0x100e01d9
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100e00d3
test dword [esi + 0x50], 0x20000000
je 0x100e01f9
cmp dword [esi + 0x4c], 0x5d
jne 0x100e01f9
push 0x5d
lea ecx, [esi + 0x24]
call fcn.100e1314
mov ecx, esi
call fcn.100e00d3
mov ecx, esi
call fcn.100e10a8
cmp dword [esi + 0x4c], 0x5d
je 0x100e0148
push 4
jmp 0x100e02a6
cmp eax, 0x28
jne 0x100e022e
mov ecx, esi
call fcn.100e00d3
mov ecx, esi
call fcn.100e0ae3
cmp dword [esi + 0x4c], 0x29
mov bl, al
je 0x100e027b
jmp 0x100e02a4
cmp eax, 0x5e
jne 0x100e023a
push 2
jmp 0x100e0173
cmp eax, 0x24
jne 0x100e0246
push 3
jmp 0x100e0173
cmp eax, 0x2a
je 0x100e029a
cmp eax, 0x2b
je 0x100e029a
cmp eax, 0x3f
je 0x100e029a
cmp eax, 0x7b
je 0x100e029a
cmp eax, 0x7d
jne 0x100e0264
test dword [esi + 0x50], edx
je 0x100e0296
cmp eax, 0x5d
jne 0x100e026e
test dword [esi + 0x50], edx
je 0x100e020a
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.100e0c57
mov ecx, esi
call fcn.100e00d3
test bl, bl
je 0x100e028d
mov ecx, esi
call fcn.100e0b93
mov cl, 1
mov bl, cl
jmp 0x100e0107
push 6
jmp 0x100e02a6
push 0xa
jmp 0x100e02a6
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.1010b07b
int3
Function at 0x100e1e73
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x24], ecx
jle 0x100e203e
mov edx, dword [ebp + 8]
push ebx
push esi
add edx, 2
push edi
xor esi, esi
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
add edx, 4
or ecx, eax
mov dword [ebp + esi*4 - 0x12c], ecx
inc esi
cmp esi, 0x10
jl 0x100e1e94
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x2c], edx
mov dword [ebp + 8], eax
mov dword [ebp - 0x28], 0x30
mov ecx, dword [eax]
mov esi, ecx
mov ebx, dword [eax - 0x34]
mov edx, ecx
rol edx, 0xd
rol ecx, 0xf
shr esi, 0xa
call fcn.1007bf0e
mov edx, esi
mov ecx, eax
call fcn.1007bf0e
mov esi, ebx
mov edx, ebx
ror ebx, 7
mov edi, eax
rol edx, 0xe
mov ecx, ebx
shr esi, 3
call fcn.1007bf0e
mov edx, esi
mov ecx, eax
call fcn.1007bf0e
add edi, eax
mov eax, dword [ebp + 8]
add edi, dword [eax - 0x38]
add edi, dword [eax - 0x14]
mov dword [eax + 8], edi
add eax, 4
dec dword [ebp - 0x28]
mov dword [ebp + 8], eax
jne 0x100e1ed5
mov esi, dword [ebp - 0x24]
lea edi, [ebp - 0x20]
push 8
add esi, 0x88
and dword [ebp + 8], 0
pop ecx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x20]
mov edx, eax
mov ecx, eax
mov esi, eax
ror edx, 0xb
ror ecx, 6
rol esi, 7
call fcn.1007bf0e
mov edx, esi
mov ecx, eax
call fcn.1007bf0e
mov edx, dword [ebp - 0x10]
mov ebx, eax
mov ecx, dword [ebp - 0xc]
not edx
and edx, dword [ebp - 8]
and ecx, dword [ebp - 0x10]
call fcn.1007bf0e
add ebx, eax
mov edx, edi
mov eax, dword [ebp + 8]
mov ecx, edi
mov esi, edi
ror edx, 0xd
ror ecx, 2
rol esi, 0xa
add ebx, dword [eax + 0x1000cec0]
add ebx, dword [ebp + eax - 0x12c]
add ebx, dword [ebp - 4]
call fcn.1007bf0e
mov edx, esi
mov ecx, eax
call fcn.1007bf0e
mov esi, dword [ebp - 0x18]
mov edi, eax
mov ecx, dword [ebp - 0x1c]
and esi, ecx
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x20]
call fcn.1007bf0e
mov edx, esi
mov ecx, eax
call fcn.1007bf0e
mov ecx, dword [ebp - 0x18]
add edi, eax
mov eax, dword [ebp - 8]
add edi, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
add eax, ebx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 8]
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
mov dword [ebp + 8], ecx
cmp ecx, 0x100
jl 0x100e1f48
mov edx, dword [ebp - 0x24]
xor ecx, ecx
add edx, 0x88
mov eax, dword [ebp + ecx*4 - 0x20]
add dword [edx], eax
inc ecx
lea edx, [edx + 4]
cmp ecx, 8
jl 0x100e2020
dec dword [ebp + 0xc]
mov edx, dword [ebp - 0x2c]
jne 0x100e1e92
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1013699f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10163610]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10128436
mov dword [ebp - 0x14], eax
cmp dword [0x110e2b18], esi
jne 0x10136a92
push 0x800
push esi
push 0x10007f54
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10136a1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10136b72
push esi
push esi
push 0x10007f54
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10136b72
push 0x10007f6c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10136b72
push eax
call ebx
push 0x10007f78
push edi
mov dword [0x110e2b18], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f88
push edi
mov dword [0x110e2b1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f9c
push edi
mov dword [0x110e2b20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x110e2b28], eax
test eax, eax
je 0x10136a8f
push 0x10007fb8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x110e2b24], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10136ab7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10136aaa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10136acc
push 4
pop eax
jmp 0x10136b74
cmp dword [ebp - 0x14], esi
je 0x10136acc
push dword [0x110e2b18]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10136ab1
mov eax, dword [0x110e2b24]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10136b2a
cmp dword [0x110e2b28], edi
je 0x10136b2a
push eax
call ebx
push dword [0x110e2b28]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10136b2a
test eax, eax
je 0x10136b2a
call ecx
test eax, eax
je 0x10136b1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10136b1f
test byte [ebp - 8], 1
jne 0x10136b2a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10136b5a
mov eax, dword [0x110e2b1c]
cmp eax, edi
je 0x10136b57
push eax
call ebx
test eax, eax
je 0x10136b57
call eax
mov esi, eax
test esi, esi
je 0x10136b57
mov eax, dword [0x110e2b20]
cmp eax, edi
je 0x10136b57
push eax
call ebx
test eax, eax
je 0x10136b57
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x110e2b18]
call ebx
test eax, eax
je 0x10136b72
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10136b74
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret