joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d444
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x46d475
mov ecx, dword [0x48376c]
mov dl, 1
mov eax, dword [0x46b8d0]
call fcn.0040c408
call fcn.004043ec
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x46d4a2
mov ecx, dword [0x483700]
mov dl, 1
mov eax, dword [0x46b8d0]
call fcn.0040c408
call fcn.004043ec
xor eax, eax
push ebp
push 0x46d51e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403d8c
cmp byte [ebp + 8], 0
je 0x46d4fa
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0046d2a4
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0046d04c
jmp 0x46d514
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0046cb1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46d53b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46d71c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0046cde4
xor eax, eax
push ebp
push 0x46d88f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x46d879
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x46d768
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46d772
call fcn.00404498
jmp 0x46d896
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00417218
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x46d86e
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x46d821
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x46d80e
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403d8c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0046d6d4
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x46d8a4]
cmp dl, byte [eax + 0x28]
je 0x46d875
call fcn.0040c32c
jmp 0x46d875
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00417238
jmp 0x46d875
cmp edi, ebx
jge 0x46d83d
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00417238
jmp 0x46d772
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00417218
cmp edx, dword [esp + 4]
jne 0x46d85d
cmp eax, dword [esp]
pop edx
pop eax
jne 0x46d772
push ebp
call fcn.0046d6d4
pop ecx
jmp 0x46d875
push ebp
call fcn.0046d6d4
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d896
mov eax, dword [ebp - 4]
call fcn.0046cdf0
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d8a8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46d9ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046cde4
xor eax, eax
push ebp
push 0x46d9ad
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46d8f8
call fcn.00404498
jmp 0x46d9b4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46d997
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46d997
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403d8c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46d997
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bb14
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46d9e4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x483870]
mov dl, 1
mov eax, dword [0x46b8d0]
call fcn.0040c444
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d9b4
mov eax, dword [ebp - 4]
call fcn.0046cdf0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46d9d1
lea eax, [ebp - 0x28]
call fcn.00404a74
ret
Function at 0x46da30
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46db7a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046cde4
xor eax, eax
push ebp
push 0x46db5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x46da95
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x46da95
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x46db47
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46daa8
call fcn.00404498
jmp 0x46db64
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46db47
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46db47
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403d8c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46db47
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bb14
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46db94
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x483870]
mov dl, 1
mov eax, dword [0x46b8d0]
call fcn.0040c444
call fcn.004043ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46db64
mov eax, dword [ebp - 4]
call fcn.0046cdf0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46db81
lea eax, [ebp - 0x28]
call fcn.00404a74
ret
Function at 0x47c8e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47ca4d
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x3c4]
cmp eax, 0xc8
jb 0x47ca32
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c4], eax
xor eax, eax
push ebp
push 0x47ca2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x3c8], 1
xor eax, eax
push ebp
push 0x47c9b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4835ac]
mov eax, dword [eax]
call fcn.004286b8
mov eax, dword [0x483648]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x47c992
inc ebx
xor esi, esi
lea ecx, [ebp - 8]
mov eax, dword [0x483648]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3cc]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x47c96c
mov eax, dword [0x483648]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c9bf
mov eax, dword [0x4835ac]
mov eax, dword [eax]
call fcn.004286c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ca54
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404a98
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebx
push esi
push edi
push str._JAVA_LAUNCHER_DEBUG
call dword [sym.imp.MSVCR100.dll_getenv]
xor ebx, ebx
pop ecx
test eax, eax
je 0x40104d
mov edi, dword [sym.imp.MSVCR100.dll_printf]
push str.Windows_original_main_args:_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
xor esi, esi
pop ecx
cmp dword [eax], ebx
jle 0x40104d
mov eax, dword [sym.imp.MSVCR100.dll___argv]
mov eax, dword [eax]
push dword [eax + esi*4]
push esi
push str.wwwd_args__d____s_n
call edi
mov eax, dword [sym.imp.MSVCR100.dll___argc]
add esp, 0xc
inc esi
cmp esi, dword [eax]
jl 0x40102e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
mov edi, eax
lea eax, [edi*4 + 4]
push eax
call sub.jli.dll_JLI_MemAlloc
pop ecx
pop ecx
mov esi, eax
call sub.jli.dll_JLI_GetStdArgs
xor ecx, ecx
cmp edi, ebx
jle 0x401087
mov edx, dword [eax + ecx*8]
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, edi
jl 0x40107c
mov eax, dword [str.java]
mov dword [esi + ecx*4], ebx
mov ecx, eax
cmp eax, ebx
jne 0x401097
mov ecx, dword [esi]
mov eax, dword [str.java]
cmp eax, ebx
jne 0x4010a2
mov eax, dword [esi]
push ebx
push ebx
push ebx
push 1
push ecx
push eax
push 0x402198
push 0x402188
push 0x403018
push 2
push 0x403010
push 2
push esi
push edi
call sub.jli.dll_JLI_Launch
add esp, 0x38
pop edi
pop esi
pop ebx
ret
Function at 0x1693058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x16931a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1002aaee
pop dword [ebp - 0x30]
mov eax, 0xcc09adf4
sub eax, 0xbc070306
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa0968a2c
sub dword [ebp - 0x40], 0x524444e1
mov dword [ebp - 0x3c], 0x4e5a617d
sub dword [ebp - 0x3c], 0x1c271538
mov dword [ebp - 0x38], 0xb9b597a8
add dword [ebp - 0x38], 0x9296ac86
mov dword [ebp - 0x34], 0x404618b0
sub dword [ebp - 0x34], 0x404618b0
lea eax, [ebp - 0x40]
push eax
mov eax, 0xa08705b1
sub eax, 0x90844579
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xd4ae0248
add dword [ebp - 0x40], 0x9fc4670e
mov dword [ebp - 0x3c], 0xb7e9ae0a
sub dword [ebp - 0x3c], 0x767d4c95
mov dword [ebp - 0x38], 0x71f387cd
add dword [ebp - 0x38], 0xf17be49f
mov dword [ebp - 0x34], 0x5164fe57
sub dword [ebp - 0x34], 0x5164fe57
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x426f683d
sub eax, 0x326ca815
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x34d90
push 0
call eax
mov ecx, 0x2147ae70
sub ecx, 0x21476ceb
xor edx, edx
add edx, eax
mov ebx, 0xea61f91
sub ebx, 0xfea28991
add ebx, dword [ebp - 0x30]
mov esi, 0xa5be6b19
sub dword [ebp - 0x28], 0x349b6f38
mov edi, dword [ebx]
xor dword [ebp - 0x2c], ebx
xor edi, esi
mov dword [edx], edi
add dword [ebp - 0x20], 0x7f4fb375
add edx, 0xe3838d1
sub edx, 0xe3838cd
add ebx, 0xd3b474f1
add ebx, 0x2c4b8b13
loop 0x1002ac0c
add eax, 0xf8e7
xor ebx, ebx
add ebx, eax
add eax, 0xa604acda
add eax, 0x59fb532b
mov ecx, 0x7e195231
sub ecx, 0x6e195231
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x100032d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7f95
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10108f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.100031b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10003363
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xccccccc
je 0x100034bf
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100ad389
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e2720]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100e2720]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10003461
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.100be670
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100ad740
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10003443
cmp ebx, 0x200
jae 0x10003441
shl ebx, 3
cmp ebx, ecx
jae 0x10003443
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10005b80
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100031b0
mov edx, dword [eax]
jmp 0x10003464
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1000348f
mov dword [ecx + eax*8], esi
jmp 0x1000349e
cmp edi, edx
jne 0x10003498
mov dword [ecx + eax*8], esi
jmp 0x100034a2
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100034a2
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10095e61
int3
Function at 0x10003d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10108f80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x200], 0xf
push 0
movups xmmword [ebp - 0x214], xmm0
push eax
mov byte [ebp - 0x214], 0
mov dword [ebp - 0x1fc], 0
call fcn.100aeba0
push 0x1f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100b9b16
mov ecx, dword [ebp - 0x200]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x10003dab
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003da1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e03
push ecx
push edx
call fcn.100ad3b9
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.10006ba0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100be5a1
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x1010e148
push 0x1f8
push eax
push dword [0x10108278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad6e1
mov esp, ebp
pop ebp
ret
call fcn.100b954f
int3

Function at 0x10003e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10108f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x1010e12c]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10003eec
xorps xmm0, xmm0
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
pop edi
mov dword [ebx + 0x14], 0xf
pop esi
mov byte [ebx], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad6e1
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x10003eb4
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call fcn.100aeec0
add esp, 0xc
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 0x20]
push esi
call fcn.10003120
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, ebx
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [ebx], xmm0
pop esi
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.100ad6e1
mov esp, ebp
pop ebp
ret