joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ccf4
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x47b06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.spdlog::pattern_formatter.0
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x46f85c
mov byte [ecx], 0
call fcn.00401370
movups xmm0, xmmword [ebp + 0xc]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
movups xmmword [edi + 0x1c], xmm0
mov byte [ebp + 0xc], 0
movq xmm0, qword [ebp + 0x1c]
movq qword [edi + 0x2c], xmm0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 1
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 3
call fcn.0040e780
mov byte [ebp - 4], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x3c], xmm0
push 0x128
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.0042733a
mov ecx, eax
add esp, 4
mov dword [ebp - 0x10], ecx
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movq qword [ecx + 4], xmm0
mov dword [ecx + 0xc], eax
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.spdlog::details::full_formatter.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], vtable.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x24], 0xfa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x6c]
cmp dword [edi + 0x70], eax
je 0x406948
mov dword [eax], ecx
add dword [edi + 0x6c], 4
jmp 0x406962
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.004126b0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x406962
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x406992
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406988
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4069a7
push edx
push ecx
call fcn.0042736a
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004421bc
int3
Function at 0x4088e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x38], ebx
cmp dword [ebx + 0x14], 0x10
jb 0x408920
mov esi, dword [ebx]
mov edi, dword [eax + 0x94]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x40894d
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x408932
mov eax, dword [ebp - 0x30]
mov edi, dword [eax + 0x94]
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax + 0xa8]
and eax, edx
mov ecx, dword [ecx + 0x9c]
mov dword [ebp - 0x3c], ecx
mov esi, dword [ecx + eax*8]
add eax, eax
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
cmp eax, edi
jne 0x40897e
mov eax, edi
jmp 0x408983
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x4089f3
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x408991
mov edx, dword [ebx]
mov ebx, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x48], ebx
cmp ebx, 0x10
mov ebx, dword [ebp - 0x38]
jb 0x4089a5
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x34], eax
call fcn.00401ed0
add esp, 8
test al, al
jne 0x4089ca
mov esi, dword [esi]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
jmp 0x408976
cmp dword [ebp - 0x48], 0x10
lea eax, [esi + 8]
jb 0x4089d5
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x4089df
mov ecx, dword [ebx]
push dword [ebp - 0x34]
mov edx, dword [ebx + 0x10]
push eax
call fcn.00401ed0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp - 0x30]
cmp edi, dword [eax + 0x94]
jne 0x408a1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret 4
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00412280
sub esp, 0x14
mov dword [ebp - 4], 0
mov ecx, esp
mov edx, eax
push str._already_exists
call fcn.004014a0
add esp, 4
call fcn.004052b0
int3
Function at 0x409650
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
push 0
test bl, bl
je 0x409678
push 0x200
jmp 0x40967d
push 0x100
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
je 0x40982c
lea eax, [ebp - 0x218]
push eax
test bl, bl
je 0x4096a3
push 0x20219
jmp 0x4096a8
push 0x20119
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4096f1
cmp eax, 2
jne 0x4096d1
push str.Key_not_found._n
call fcn.004020f0
add esp, 4
jmp 0x40982c
push str.Error_opening_key._n
call fcn.004020f0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
lea edi, [esi + eax*2]
je 0x409713
mov eax, 0x5c
mov word [edi], ax
add edi, 2
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4097f4
nop
xor eax, eax
mov ecx, 0x208
mov word [edi], ax
mov eax, esi
nop dword [eax]
cmp word [eax], 0
je 0x40976e
add eax, 2
sub ecx, 1
jne 0x409760
test ecx, ecx
je 0x4097a5
mov edx, ecx
lea eax, [ebp - 0x214]
push ecx
neg edx
push eax
sbb edx, edx
lea eax, [ecx - 0x208]
and edx, eax
mov eax, 0x208
sub eax, ecx
add edx, 0x208
push ecx
add eax, eax
neg ecx
sbb ecx, ecx
and ecx, eax
add ecx, esi
call fcn.004029c0
push ebx
mov edx, esi
mov ecx, 0x80000002
call fcn.00409650
add esp, 4
test eax, eax
je 0x4097f4
lea eax, [ebp - 0x224]
mov dword [ebp - 0x21c], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x409750
xor eax, eax
mov word [edi - 2], ax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
test bl, bl
je 0x409813
push 0x200
jmp 0x409818
push 0x100
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
test eax, eax
jne 0x4096de
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427329
mov esp, ebp
pop ebp
ret
Function at 0x40b830
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, ecx
mov dword [ebp - 0x218], 0
mov eax, edx
mov dword [ebp - 0x214], 0xf
push ebx
push esi
mov byte [ebp - 0x228], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b867
sub eax, esi
lea ecx, [ebp - 0x228]
push eax
push edx
call fcn.00401370
cmp dword [ebp - 0x214], 0x10
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push 0x208
push eax
call fcn.00445773
add esp, 0xc
mov dword [ebp - 0x280], 0x44
lea eax, [ebp - 0x238]
xorps xmm0, xmm0
movlpd qword [ebp - 0x27c], xmm0
movlpd qword [ebp - 0x274], xmm0
push eax
lea eax, [ebp - 0x280]
movlpd qword [ebp - 0x26c], xmm0
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [ebp - 0x210]
movlpd qword [ebp - 0x264], xmm0
push eax
push 0
movlpd qword [ebp - 0x25c], xmm0
movlpd qword [ebp - 0x254], xmm0
movlpd qword [ebp - 0x24c], xmm0
movlpd qword [ebp - 0x244], xmm0
movups xmmword [ebp - 0x238], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x238]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x238]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x234]
call esi
mov edx, dword [ebp - 0x214]
cmp edx, 0x10
jb 0x40b985
mov ecx, dword [ebp - 0x228]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b97b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b997
push edx
push ecx
call fcn.0042736a
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00427329
mov esp, ebp
pop ebp
ret
call fcn.004421bc
int3
Function at 0x40b9a0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d5ab
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x33c]
push eax
push 0x20219
push 0
push str.SOFTWAREASUSAXSP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bbcc
lea eax, [ebp - 0x340]
mov dword [ebp - 0x340], 0x208
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x344]
push eax
push 0
push 0x46fc70
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bbcc
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40bbc0
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
mov eax, 0x104
lea ecx, [ebp - 0x320]
cmp word [ecx], 0
je 0x40ba66
add ecx, 2
sub eax, 1
jne 0x40ba58
test eax, eax
je 0x40baa1
push ecx
mov edx, eax
neg edx
push str.__UnregServer
sbb edx, edx
push ecx
lea ecx, [eax - 0x104]
and edx, ecx
mov ecx, 0x104
sub ecx, eax
add edx, 0x104
add ecx, ecx
neg eax
sbb eax, eax
and eax, ecx
lea ecx, [ebp - 0x320]
add ecx, eax
call fcn.004029c0
push 0x104
lea eax, [ebp - 0x320]
push eax
push 0x104
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.00445ecd
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x328], 0
add esp, 0x14
mov dword [ebp - 0x324], 0xf
mov byte [ebp - 0x338], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40baf0
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.00401370
mov dword [ebp - 4], 0
call fcn.00408850
push 0x21
push str.UnRegisterATKService:_filename_
mov dword [ebp - 0x354], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x338]
push eax
sub esp, 0x10
mov dword [ebp - 0x350], 0
movq xmm0, qword [ebp - 0x354]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x324]
cmp edx, 0x10
jb 0x40bb9a
mov ecx, dword [ebp - 0x338]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40bb90
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bbe5
push edx
push ecx
call fcn.0042736a
add esp, 8
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x324], 0xf
mov byte [ebp - 0x338], 0
call fcn.0040b830
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret
call fcn.004421bc
int3
Function at 0x40c500
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d688
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x40c57f
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
movq xmm0, qword [ebp - 0x34]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.scmServer_is_NULL
mov dword [eax + 4], 0x11
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], edi
call fcn.00405a70
xor eax, eax
jmp 0x40c6d2
lea ecx, [ebp - 0x28]
call fcn.00409850
mov dword [ebp - 4], 0
call fcn.00408850
push 0x1b
push str.StartATKCOMService:_name_
mov dword [ebp - 0x34], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x28]
push eax
sub esp, 0x10
mov dword [ebp - 0x30], 0
movq xmm0, qword [ebp - 0x34]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x10
cmovae eax, dword [ebp - 0x28]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x40c62d
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
movq xmm0, qword [ebp - 0x34]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.schService_is_NULL
mov dword [eax + 4], 0x12
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], esi
call fcn.00405a70
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
jmp 0x40c6a0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
movq xmm0, qword [ebp - 0x34]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
test ebx, ebx
je 0x40c681
mov dword [eax], str.StartATKCOMService_is_ok
mov dword [eax + 4], 0x18
jmp 0x40c68e
mov dword [eax], str.StartATKCOMService_is_fail
mov dword [eax + 4], 0x1a
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x40c6d0
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c6c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c6ee
push edx
push ecx
call fcn.0042736a
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret
call fcn.004421bc
int3
Function at 0x40ce30
Capabilities:
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d768
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x288
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x284], eax
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov edi, dword [eax]
mov dword [ebp - 0x27c], esi
test edi, edi
jne 0x40ce94
call sub.KERNEL32.dll_GetCurrentProcessId
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
push eax
push 2
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x27c], eax
cmp eax, 0xffffffff
jne 0x40cef5
xor eax, eax
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ced7
sub ecx, edx
sar ecx, 1
push ecx
push 0
mov ecx, esi
call fcn.00401230
jmp 0x40cf7d
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x278], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40cf34
cmp edi, dword [ebp - 0x270]
je 0x40cf9d
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40cf11
movq xmm0, qword [ebp - 0x1c]
movq qword [ebp - 0x288], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x298], xmm0
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x298]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x288]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0x284]
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov dword [ecx], eax
xor eax, eax
lea ecx, [ebp - 0x254]
mov word [ebp - 0x44], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cfd0
sub ecx, edx
lea eax, [ebp - 0x254]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00401230
lea ecx, [ebp - 0x2c]
call fcn.00401090
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [ebp - 0x298], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [ebp - 0x288], xmm0
jmp 0x40cf4c
Function at 0x40ebf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x40ec0c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x40ec28
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x40ec17
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x40ec50
mov eax, ebx
jmp 0x40ec54
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x40ece9
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x40ec66
mov eax, dword [edi]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
jb 0x40ec72
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov edx, dword [esi + 0x18]
push eax
call fcn.00401ed0
add esp, 8
test al, al
jne 0x40ec8f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x40ec48
mov edi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
nop word [eax + eax]
cmp dword [ebp - 8], ebx
jne 0x40eca9
mov eax, ebx
jmp 0x40ecb0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x40ece1
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x40ecc0
mov edx, dword [esi + 8]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x40ecca
mov ecx, dword [edi]
push dword [esi + 0x18]
push edx
mov edx, dword [edi + 0x10]
call fcn.00401ed0
add esp, 8
test al, al
je 0x40ece1
mov esi, dword [esi]
jmp 0x40eca0
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0x10], esi
jne 0x40eced
mov edi, ebx
mov esi, ebx
mov eax, edi
xor ebx, ebx
mov dword [ebp + 8], ebx
cmp eax, esi
je 0x40ed02
mov eax, dword [eax]
inc ebx
cmp eax, esi
jne 0x40ecf8
mov dword [ebp + 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 4]
cmp edi, dword [eax]
jne 0x40ed20
cmp esi, eax
jne 0x40ed20
call fcn.0040eb70
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, esi
je 0x40ed15
mov ebx, ecx
push edi
mov edi, dword [edi]
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.0040f720
cmp edi, esi
jne 0x40ed26
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x40f73b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x40f757
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x40f746
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x40f790
cmp eax, edi
jne 0x40f788
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x40f798
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x40f798
cmp eax, edi
jne 0x40f79b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00412c00
push 0x28
push edi
call fcn.0042736a
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x417db0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45dff9
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea esi, [ebx + 0x30]
mov dword [ebp - 0x7c], 0
push esi
mov dword [ebp - 0x80], esi
call fcn.004260a7
add esp, 4
test eax, eax
je 0x417e03
push eax
call fcn.00426278
add esp, 4
push 0x64
mov dword [ebp - 4], 1
call fcn.0042733a
mov edi, eax
add esp, 4
mov dword [ebp - 0x84], edi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], vtable.std::_Func_impl_no_alloc_class__lambda_c4a36e7366b61b94062b933b1305c053___void___.0
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea eax, [edi + 0xc]
mov dword [ebp - 4], 4
push 2
push eax
call fcn.00426086
lea eax, [edi + 0x3c]
push eax
call fcn.00425ce4
add esp, 0xc
cmp dword [ebp - 0x74], 0
jl 0x417e7d
jg 0x417e79
cmp dword [ebp - 0x78], 0
jbe 0x417e7d
mov al, 1
jmp 0x417e7f
xor al, al
mov byte [edi], al
test al, al
je 0x417f25
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x417eb2
mov eax, dword [ecx]
lea edx, [ebp - 0x68]
push edx
call dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x90]
call fcn.0041d6e0
cmp dword [edi + 8], 0
mov ecx, eax
jne 0x417fb2
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 8], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
cmp dword [ebp - 0x8c], 0
jne 0x417fb7
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x417f25
mov edx, dword [ecx]
lea eax, [ebp - 0x68]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], 2
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x417f59
mov edx, dword [ecx]
lea eax, [ebp - 0x38]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x14], 0
lea eax, [ebx + 0x110]
lea ecx, [ebp - 0x74]
cmp eax, ecx
je 0x417f71
mov ecx, dword [eax]
mov dword [eax], edi
test ecx, ecx
je 0x417f77
push ecx
jmp 0x417f72
push edi
call fcn.0040f200
push esi
mov dword [ebp - 4], 0xc
call fcn.004260cc
add esp, 4
test eax, eax
je 0x417f94
push eax
call fcn.00426278
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret 8
call fcn.00445687
call fcn.00445687
int3