joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100817c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6e6b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
cmp byte [esi + 0x450], 0
je 0x100817ff
xor eax, eax
jmp 0x1008188b
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.1009edd0
add esp, 8
push 1
push 0x1010b8a4
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 0
call fcn.10009520
push dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 0x10
lea eax, [esi + 0x214]
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
push eax
push ecx
call dword [0x100ef3dc]
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
cmp dword [ebp - 0x21c], 0x10
jb 0x10081888
push dword [ebp - 0x230]
call fcn.100dd8b4
add esp, 4
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret

Function at 0x10081d30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10192358
push 0x100de1bf
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101a12fc]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10081e01
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x10081e01
mov esi, dword [ebp + 0xc]
cmp esi, 0x40
jae 0x10081da6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xc000007b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10081d88
mov edx, dword [ecx + 0x3c]
cmp edx, esi
jae 0x10081d88
cmp edx, 0xffffffe7
jae 0x10081d88
lea eax, [edx + 0x18]
cmp eax, esi
jae 0x10081d88
lea esi, [edx + ecx]
mov dword [ebp - 0x20], esi
lea eax, [esi + 0xf8]
push eax
call fcn.1008a920
add esp, 4
test al, al
je 0x10081d88
cmp dword [esi], 0x4550
jne 0x10081d88
mov dword [ebp - 4], 0xfffffffe
mov dword [edi], esi
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xc000000d
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100836b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
movzx eax, word [ecx + 0x14]
lea esi, [ecx + 0x18]
movzx edx, word [ecx + 6]
add esi, eax
xor ecx, ecx
mov dword [ebp + 0x10], edx
xor eax, eax
cmp cx, dx
jae 0x10083708
mov ebx, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp + 0x14]
lea ebx, [ebx]
mov edx, dword [esi + 0xc]
test ebx, ebx
jb 0x100836ff
ja 0x100836ed
cmp edi, edx
jb 0x100836ff
mov ecx, dword [esi + 0x10]
add ecx, edx
test ebx, ebx
jb 0x10083711
ja 0x100836fc
cmp edi, ecx
jb 0x10083711
mov ecx, dword [ebp + 0x10]
inc eax
add esi, 0x28
cmp ax, cx
jb 0x100836e0
pop edi
pop esi
xor eax, eax
xor edx, edx
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x14]
xor edx, edx
sub eax, dword [esi + 0xc]
sbb edx, edx
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
add eax, edi
pop edi
pop esi
adc edx, ebx
pop ebx
pop ebp
ret
Function at 0x100864d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e728b
mov eax, dword fs:[0]
push eax
sub esp, 0x6a8
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 0x10]
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.100dd9d6
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1008653f
xor al, al
jmp 0x10086665
mov edi, dword [0x100ef4b4]
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push str.downlevel_
push 0x104
push eax
call edi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.1009ef30
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x10086572
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call edi
add esp, 0x10
cmp dword [ebp - 0x21c], 8
jb 0x1008659d
push dword [ebp - 0x230]
call fcn.100dd8b4
add esp, 4
push 0xffffffffffffffff
push 0x1010ba70
lea eax, [ebp - 0x218]
push 0x104
push eax
call edi
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x6a4]
call fcn.100804d0
lea eax, [ebp - 0x25c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100d07ae
add esp, 0x1c
test al, al
je 0x1008664f
push dword [ebp - 0x25c]
lea eax, [ebp - 0x6a4]
push eax
call fcn.100818b0
push 1
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x2fc]
push ebx
push eax
call fcn.100a2370
add esp, 0x18
test al, al
je 0x1008664f
imul eax, dword [ebp - 0x6b0], 0x58
add eax, dword [ebp - 0x30c]
cmp byte [eax + 0xc], 0
jne 0x10086681
push str.assertion_failure__api_set_not_forwarded
call fcn.10044e50
add esp, 4
xor bl, bl
lea ecx, [ebp - 0x6a4]
mov dword [ebp - 4], 0xffffffff
call fcn.10080940
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
push 1
lea edi, [eax + 0x10]
mov byte [ebp - 0x6a8], 0x2e
push 0
lea eax, [ebp - 0x6a8]
mov ecx, edi
push eax
call fcn.1006c680
mov dword [ebp - 0x6ac], eax
cmp eax, 0xffffffff
je 0x1008664f
push eax
push 0
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.10035e70
push eax
mov ecx, esi
call fcn.10020500
lea ecx, [ebp - 0x230]
call fcn.1006b340
mov eax, dword [ebp - 0x6ac]
mov ecx, edi
push 0xffffffffffffffff
inc eax
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.10035e70
push eax
mov ecx, ebx
call fcn.10020500
lea ecx, [ebp - 0x248]
call fcn.1006b340
push dword [ebp + 8]
push esi
call fcn.1001f9f0
add esp, 8
test al, al
je 0x10086736
cmp dword [esi + 0x14], 0x10
jb 0x10086711
mov eax, dword [esi]
jmp 0x10086713
mov eax, esi
push str.kernel32
push eax
call dword [0x100ef398]
add esp, 8
test eax, eax
jne 0x1008664f
push str.kernelbase
mov ecx, esi
call fcn.10018390
cmp dword [ebx + 0x10], 0
setne bl
jmp 0x10086651
Function at 0x1008b0c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ebx
cdq
and edx, 3
add edx, eax
sar edx, 2
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ecx + edx*4]
neg edx
je 0x1008b111
jmp 0x1008b0f0
imul eax, dword [edi + edx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
inc edx
jne 0x1008b0f0
mov eax, ebx
xor ecx, ecx
and eax, 3
dec eax
je 0x1008b131
dec eax
je 0x1008b128
dec eax
jne 0x1008b147
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, ebx
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
pop ebp
ret

Function at 0x1008bda0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x1008bdf3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1008be1f
cmp dword [ecx], edi
jne 0x1008be17
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x1008be27
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1008be27
cmp dword [ecx], edi
jne 0x1008be2a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1008c660
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edx, ecx
and edx, eax
cmp dword [ebx + 0x18], edx
ja 0x1008c6b3
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edx, eax
mov edi, dword [ebx + 8]
lea eax, [edx*8]
mov ecx, dword [ebx]
mov dword [ebp - 4], eax
lea esi, [edi + eax]
mov eax, dword [esi]
cmp eax, ecx
jne 0x1008c6cf
mov esi, ecx
jmp 0x1008c6d4
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1008c6ed
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1008c719
cmp esi, dword [edi + edx*8]
jne 0x1008c6e0
mov edi, dword [ecx]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [edi + 4]
push edi
call fcn.1008c610
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x1008c72b
push str.list_T__too_long
call dword [0x100ef2ac]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x1008c762
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1008c77b
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x1008c79d
cmp eax, esi
jne 0x1008c783
mov dword [ecx], edi
jmp 0x1008c79d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1008c79d
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.100ab5d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1008d0d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1008d100
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1008d102
movzx eax, ax
or eax, 0x80070000
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x10099d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
push 0x104
push 0x101baa58
call dword [0x100ef38c]
add esp, 0xc
push 0
push 0
push 0x101baa58
push 0x10097c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
push 0x64
push esi
call edi
cmp eax, 0x102
jne 0x10099daf
push ebx
mov ebx, dword [0x100ef738]
mov edi, edi
call ebx
push 0x64
push esi
call edi
cmp eax, 0x102
je 0x10099da0
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret

Function at 0x1009a0a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edx, ecx
and edx, eax
cmp dword [ebx + 0x18], edx
ja 0x1009a0f3
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edx, eax
mov edi, dword [ebx + 8]
lea eax, [edx*8]
mov ecx, dword [ebx]
mov dword [ebp - 4], eax
lea esi, [edi + eax]
mov eax, dword [esi]
cmp eax, ecx
jne 0x1009a10f
mov esi, ecx
jmp 0x1009a114
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x1009a12d
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1009a159
cmp esi, dword [edi + edx*8]
jne 0x1009a120
mov edi, dword [ecx]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [edi + 4]
push edi
call fcn.1009a020
mov edx, eax
mov ecx, 0x7b301d
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x1009a16b
push str.list_T__too_long
call dword [0x100ef2ac]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x1009a1a2
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1009a1bb
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x1009a1dd
cmp eax, esi
jne 0x1009a1c3
mov dword [ecx], edi
jmp 0x1009a1dd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1009a1dd
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.1007bfe0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a9c20
Capabilities:
Resume thread

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0x101bac41], 0
je 0x100a9c44
cmp dword [0x101baf00], eax
je 0x100a9c4f
push 0x101bb8c0
call dword [0x101bc9c4]
jmp 0x100a9c4f
push 0x101bc280
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push esi
push edi
mov edi, dword [0x101babdc]
xor ebx, ebx
mov esi, dword [edi]
cmp esi, edi
je 0x100a9c75
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x100a9c6f
inc ebx
mov esi, dword [esi]
cmp esi, edi
jne 0x100a9c60
cmp byte [0x101bac41], 0
je 0x100a9c9d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101baf00], eax
je 0x100a9ca8
push 0x101bb8c0
call dword [0x101bc9d4]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
push 0x101bc280
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x100a9da0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9d48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101a12fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp byte [0x101bac41], 0
je 0x100a9dea
cmp dword [0x101baf00], eax
je 0x100a9df5
push 0x101bb8c0
call dword [0x101bc9c4]
jmp 0x100a9df5
push 0x101bc280
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0xd], 1
mov edi, dword [0x101babdc]
xor ebx, ebx
mov dword [ebp - 4], 0
mov esi, dword [edi]
cmp esi, edi
je 0x100a9e37
mov edi, edi
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x100a9e21
inc ebx
jmp 0x100a9e31
push dword [esi + 0x14]
push str.Failed_to_suspend_thread_0x_X..._n
call fcn.10044d60
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x100a9e10
cmp byte [0x101bac41], 0
mov dword [ebp - 4], 0xffffffff
je 0x100a9e74
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101baf00], eax
je 0x100a9e7f
push 0x101bb8c0
call dword [0x101bc9d4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101bc280
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a9ea0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9d80
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x101a12fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 5
call edi
cmp eax, 0xc0000004
jne 0x100aa08e
mov eax, dword [ebp - 0x1c]
push str._dbg_threadwaitreason
lea esi, [eax + eax]
push esi
call fcn.100cac00
push esi
push 0
push eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], esi
call fcn.100dd9d6
add esp, 0x14
mov ebx, dword [ebp - 0x28]
push 0
push esi
push ebx
push 5
mov dword [ebp - 4], 0
call edi
test eax, eax
js 0x100aa075
lea ecx, [ebp - 0xd]
call fcn.100a87a0
mov byte [ebp - 4], 1
mov edi, edi
xor edi, edi
cmp dword [ebx + 4], edi
jbe 0x100aa020
lea esi, [ebx + 0xf0]
mov eax, dword [esi - 0x14]
mov ecx, 0x101babdc
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100565c0
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
je 0x100aa013
lea esp, [esp]
mov eax, dword [eax]
inc edx
cmp eax, ecx
jne 0x100a9f70
test edx, edx
je 0x100aa013
lea eax, [ebp - 0x14]
mov ecx, 0x101bac00
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100ac500
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x101bac00]
cmp eax, ecx
jne 0x100aa00e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
lea ecx, [ebp - 0xe]
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], eax
push ecx
push 0x101babff
push dword [eax + 4]
mov ecx, 0x101bac00
push eax
call fcn.10054ef0
mov edx, dword [0x101bac04]
mov ecx, 0xffffffe
sub ecx, edx
mov dword [ebp - 0x18], eax
cmp ecx, 1
jb 0x100aa02d
mov ecx, dword [ebp - 0x20]
inc edx
mov dword [0x101bac04], edx
mov dword [ecx + 4], eax
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov ecx, 0x101bac00
mov eax, dword [0x101bac00]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.100aa620
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [esi]
mov dword [eax + 0xc], ecx
inc edi
add esi, 0x40
cmp edi, dword [ebx + 4]
jb 0x100a9f41
mov eax, dword [ebx]
test eax, eax
je 0x100aa038
add ebx, eax
jmp 0x100a9f30
push str.list_T__too_long
call dword [0x100ef2ac]
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 0
jbe 0x100aa075
cmp byte [0x101bac41], 0
je 0x100aa06a
dec dword [0x101baf04]
jne 0x100aa075
push 0x101bb8c0
mov dword [0x101baf00], 0
call dword [0x101bc9d8]
jmp 0x100aa075
push 0x101bc280
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100aa08e
push 0
push eax
call fcn.100cacb0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100aa300
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x101bac40], 0
jne 0x100aa443
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push str.kernel32.dll
mov dword [0x101bc9dc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.InitializeSRWLock
push edi
call esi
push str.AcquireSRWLockShared
push edi
mov dword [0x101bc9c0], eax
call esi
push str.TryAcquireSRWLockShared
push edi
mov dword [0x101bc9c4], eax
call esi
push str.AcquireSRWLockExclusive
push edi
mov dword [0x101bc9c8], eax
call esi
push str.TryAcquireSRWLockExclusive
push edi
mov dword [0x101bc9cc], eax
call esi
push str.ReleaseSRWLockShared
push edi
mov dword [0x101bc9d0], eax
call esi
push str.ReleaseSRWLockExclusive
push edi
mov dword [0x101bc9d4], eax
call esi
mov ebx, dword [0x101bc9c0]
mov dword [0x101bc9d8], eax
test ebx, ebx
je 0x100aa401
cmp dword [0x101bc9c4], 0
je 0x100aa401
cmp dword [0x101bc9c8], 0
je 0x100aa401
cmp dword [0x101bc9cc], 0
je 0x100aa401
cmp dword [0x101bc9d0], 0
je 0x100aa401
cmp dword [0x101bc9d4], 0
je 0x100aa401
test eax, eax
je 0x100aa401
push 0x9c0
push 0
push 0x101bb640
mov byte [0x101bac41], 1
call fcn.100dd9d6
add esp, 0xc
mov esi, 0x101bb640
mov edi, 0x27
lea esp, [esp]
push esi
call ebx
add esi, 0x40
dec edi
je 0x100aa439
mov ebx, dword [0x101bc9c0]
jmp 0x100aa3f0
push 0x9c0
push 0
push 0x101bc000
mov byte [0x101bac41], 0
call fcn.100dd9d6
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
mov esi, 0x101bc000
mov edi, 0x27
lea esp, [esp]
push esi
call ebx
add esi, 0x40
dec edi
jne 0x100aa430
pop edi
pop esi
mov byte [0x101bac40], 1
pop ebx
ret