joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100187f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10018849
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10018849
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1001883a
cmp esi, edx
jae 0x10018849
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10018828
cmp esi, edx
jae 0x10018849
cmp word [esi], 0
je 0x10018849
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1001cbf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101e4640
mov dword [ebp - 0x6c], 0x740068
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x700074
push edi
mov dword [ebp - 0x64], 0x2f003a
mov edx, 0x34
mov dword [ebp - 0x60], 0x25002f
sub esi, eax
mov dword [ebp - 0x5c], 0x2f0073
mov dword [ebp - 0x58], 0x6e0065
mov dword [ebp - 0x54], 0x720063
mov dword [ebp - 0x50], 0x700079
mov dword [ebp - 0x4c], 0x2f0074
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x660074
mov dword [ebp - 0x40], 0x67002f
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x700054
mov dword [ebp - 0x34], 0x3f0069
mov dword [ebp - 0x30], 0x720070
mov dword [ebp - 0x2c], 0x64006f
mov dword [ebp - 0x28], 0x630075
mov dword [ebp - 0x24], 0x3d0074
mov dword [ebp - 0x20], 0x730025
mov dword [ebp - 0x1c], 0x630026
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x1001ccee
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001ccee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001ccd0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret

Function at 0x1001cd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101e45c8
mov dword [ebp - 0x6c], 0x740068
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x700074
push edi
mov dword [ebp - 0x64], 0x2f003a
mov edx, 0x34
mov dword [ebp - 0x60], 0x25002f
sub esi, eax
mov dword [ebp - 0x5c], 0x2f0073
mov dword [ebp - 0x58], 0x6e0065
mov dword [ebp - 0x54], 0x720063
mov dword [ebp - 0x50], 0x700079
mov dword [ebp - 0x4c], 0x2f0074
mov dword [ebp - 0x48], 0x6e0069
mov dword [ebp - 0x44], 0x660074
mov dword [ebp - 0x40], 0x67002f
mov dword [ebp - 0x3c], 0x740065
mov dword [ebp - 0x38], 0x700054
mov dword [ebp - 0x34], 0x3f0069
mov dword [ebp - 0x30], 0x720070
mov dword [ebp - 0x2c], 0x64006f
mov dword [ebp - 0x28], 0x630075
mov dword [ebp - 0x24], 0x3d0074
mov dword [ebp - 0x20], 0x730025
mov dword [ebp - 0x1c], 0x630026
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x6e006e
mov dword [ebp - 0x10], 0x6c0065
mov dword [ebp - 0xc], 0x25003d
mov dword [ebp - 8], 0x73
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x1001ce0e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1001ce0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1001cdf0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x1001e1f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e4ae
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x101dd594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call esi
push dword [edi + 0xc]
lea eax, [edi + 0xc]
mov dword [ebp - 0x1c], eax
call esi
mov eax, dword [edi + 0x10]
xorps xmm0, xmm0
mov esi, dword [edi]
push 0x20
mov dword [ebp - 0x10], eax
movlpd qword [ebp - 0x28], xmm0
call fcn.10127dee
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1001e26d
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
call fcn.1001c7e0
jmp 0x1001e26f
xor eax, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
push eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.1001c130
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
lea eax, [edi + 8]
push 0x7530
push eax
push dword [esi + 0x3c]
mov dword [ebp - 4], 1
call fcn.1001d620
mov edi, dword [ebp - 0x24]
test eax, eax
je 0x1001e3a9
or esi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1001e2e6
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001e2e6
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x1001e2e6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
push 0x20
movlpd qword [ebp - 0x14], xmm0
mov edi, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
call fcn.10127dee
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x1001e324
xorps xmm0, xmm0
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
call fcn.1001c7e0
jmp 0x1001e326
xor eax, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
push eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.1001c130
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
push 0x7530
push dword [ebp - 0x1c]
mov dword [ebp - 4], 3
push dword [edi + 0x40]
call fcn.1001d620
mov edi, dword [ebp - 0x10]
test eax, eax
je 0x1001e3a3
test edi, edi
je 0x1001e38d
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001e38d
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x1001e38d
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1001e3ce
jmp 0x1001e3b0
test edi, edi
je 0x1001e3ce
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001e3ce
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x1001e3ce
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10029f00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f77b
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x101942d8
push 0
push 0
push str.tpi_start_load
call fcn.1001e650
mov ecx, eax
call fcn.100caab0
cmp dword [0x101e46ac], 0
jne 0x1002a035
call fcn.100d1170
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1002a010
push 0x5d
push str.d:jenkins.jenkinsworkspacemultiplugin_nativemultipluginencryptplugincloudpopwindow.cpp
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], al
call fcn.10019000
push 3
push 0x10193e24
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.10019000
mov byte [ebp - 4], 1
call fcn.100d1170
mov edi, eax
lea ecx, [ebp - 0xdc]
push 0x2dd
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100167c0
mov esi, eax
push str.StartPlugin
push esi
mov byte [ebp - 4], 2
call fcn.100174d0
mov edx, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [edx + 0x1c]
lea ecx, [ebp - 0xdc]
call fcn.10017580
lea ecx, [ebp - 0x2c]
call fcn.10017170
lea ecx, [ebp - 0x44]
call fcn.10017170
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0x10027d80
push 0
push 0
call fcn.1015867f
add esp, 0x18
mov dword [0x101e46ac], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret

Function at 0x1002b660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017f8b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101dd594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10127dee
mov edi, eax
add esp, 4
test edi, edi
je 0x1002b712
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100a2e79
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002edd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fc0b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x94]
push 0x84
push 0
push eax
call fcn.10150460
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x94]
add esp, 0xc
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push str.closebtn
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0
call fcn.100dc602
test al, al
je 0x1002ee75
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1002ee5e
push eax
push 0x101942d8
push eax
push eax
push str.download_fail_close
jmp 0x1002eecf
cmp eax, 1
jne 0x1002eedb
push 0
push 0x101942d8
push 0
push 0
push str.install_fail_close
jmp 0x1002eecf
push str.openbtn
lea ecx, [ebp - 0x94]
call fcn.100dc602
test al, al
je 0x1002eee4
push 1
push 0
push 0
push str.http:__www.pcjiami.cn_
push 0x101951bc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi + 0x77c]
test eax, eax
jne 0x1002eeba
push eax
push 0x101942d8
push eax
push eax
push str.download_fail_click
jmp 0x1002eecf
cmp eax, 1
jne 0x1002eedb
push 0
push 0x101942d8
push 0
push 0
push str.install_fail_click
call fcn.1001e650
mov ecx, eax
call fcn.100caab0
push 1
mov ecx, edi
call fcn.100dbc4c
lea ecx, [ebp - 0x94]
call fcn.100dc53c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
Function at 0x10032360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180098
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x38]
mov dword [0x101e4974], edi
call fcn.100317e0
cmp byte [edi + 8], 0
jne 0x10032450
push 1
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100323d0
push eax
call ebx
mov dword [edi + 0x10], esi
test esi, esi
je 0x10032486
lea eax, [ebp - 0x14]
mov byte [edi + 8], 1
push eax
push 0
push edi
push 0x100324c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [edi + 0xc]
mov esi, eax
lea eax, [edi + 0xc]
test ecx, ecx
je 0x10032407
push ecx
call ebx
lea eax, [edi + 0xc]
mov dword [eax], esi
test esi, esi
je 0x1003249d
push 0xf
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push 0x100320c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x1003243c
push eax
call ebx
mov dword [edi + 0x7c], esi
test esi, esi
jne 0x10032450
lea ecx, [edi + 0xc]
call fcn.10031970
push eax
call ebx
jmp 0x1003249d
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x10032468
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 0x28
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x101c849c
push eax
call fcn.1014f548
push 0x101c8a34
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
call fcn.1014f548
int3
Function at 0x10034980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10180463
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101dd594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
lea edi, [esi + 8]
mov dword [esi + 4], 0
lea ecx, [esi + 0x20]
mov dword [edi + 0xc], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ecx], eax
mov dword [esi], vtable.CLockScreenChecker.0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
push ecx
push 0x101dd160
push section..data
push 0x101e8358
call fcn.1001a7f0
movzx ebx, ax
add esp, 0x14
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x10034a52
call fcn.100a199a
mov dword [esi + 0x14], eax
test eax, eax
jne 0x10034a52
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call fcn.100a1a9c
test bx, bx
je 0x10034a3e
test edi, edi
je 0x10034ae2
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x101dd004
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x101dd01c]
mov dword [edi + 8], eax
push 0x101dd004
mov dword [0x101dd01c], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x101dd030]
mov eax, dword [0x101dd038]
mov edx, dword [0x101dd02c]
sub eax, ecx
push 0
push dword [0x101e835c]
push 0
push 0
push eax
mov eax, dword [0x101dd034]
sub eax, edx
push eax
push ecx
push edx
push SysReAllocString
push 0
push ebx
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push 0xc0000005
call fcn.1001ba00
int3
Function at 0x10037320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, ecx
mov ebx, dword [ebp + 8]
push edi
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
lea edi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, edi
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x10037396
cmp eax, esi
jne 0x1003738e
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [edi + ecx + 4], eax
jmp 0x1003739e
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1003739e
cmp eax, esi
jne 0x1003739e
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100373bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x10
push esi
call fcn.10127e1e
add esp, 8
mov dword [ebx], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100394b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov ecx, dword [eax + edx*8]
add edx, edx
mov edi, dword [eax + edx*4]
lea edx, [eax + edx*4]
mov dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
nop dword [eax]
cmp dword [ebp + 8], esi
jne 0x10039519
mov eax, esi
jmp 0x1003951e
mov eax, dword [edx + 4]
mov eax, dword [eax]
cmp ecx, eax
je 0x10039538
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x1003952d
mov ecx, dword [ecx]
jmp 0x10039510
pop edi
pop esi
mov dword [ebx], ecx
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1003a340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101e4e98
mov dword [ebp - 0xa0], 0x4b0048
lea esi, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x4c005f
mov edx, 0x4e
mov dword [ebp - 0x94], 0x43004f
sub esi, eax
mov dword [ebp - 0x90], 0x4c0041
mov dword [ebp - 0x8c], 0x4d005f
mov dword [ebp - 0x88], 0x430041
mov dword [ebp - 0x84], 0x490048
mov dword [ebp - 0x80], 0x45004e
mov dword [ebp - 0x7c], 0x53005c
mov dword [ebp - 0x78], 0x46004f
mov dword [ebp - 0x74], 0x570054
mov dword [ebp - 0x70], 0x520041
mov dword [ebp - 0x6c], 0x5c0045
mov dword [ebp - 0x68], 0x69004d
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x73006f
mov dword [ebp - 0x5c], 0x66006f
mov dword [ebp - 0x58], 0x5c0074
mov dword [ebp - 0x54], 0x690057
mov dword [ebp - 0x50], 0x64006e
mov dword [ebp - 0x4c], 0x77006f
mov dword [ebp - 0x48], 0x5c0073
mov dword [ebp - 0x44], 0x750043
mov dword [ebp - 0x40], 0x720072
mov dword [ebp - 0x3c], 0x6e0065
mov dword [ebp - 0x38], 0x560074
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x690073
mov dword [ebp - 0x2c], 0x6e006f
mov dword [ebp - 0x28], 0x55005c
mov dword [ebp - 0x24], 0x69006e
mov dword [ebp - 0x20], 0x73006e
mov dword [ebp - 0x1c], 0x610074
mov dword [ebp - 0x18], 0x6c006c
mov dword [ebp - 0x14], 0x57005c
mov dword [ebp - 0x10], 0x430065
mov dword [ebp - 0xc], 0x610068
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffb0]
test ecx, ecx
je 0x1003a4af
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003a4af
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003a491
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x1003a7a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa0], 0x4b0048
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0xa0]
mov eax, 0x101e4f40
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x43005f
mov edx, 0x4d
mov dword [ebp - 0x94], 0x520055
sub esi, eax
mov dword [ebp - 0x90], 0x450052
mov dword [ebp - 0x8c], 0x54004e
mov dword [ebp - 0x88], 0x55005f
mov dword [ebp - 0x84], 0x450053
mov dword [ebp - 0x80], 0x5c0052
mov dword [ebp - 0x7c], 0x4f0053
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x650057
mov dword [ebp - 0x10], 0x680043
mov dword [ebp - 0xc], 0x740061
lea ecx, [edx + 0x7fffffb1]
test ecx, ecx
je 0x1003a90e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003a90e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003a8f0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x1003a930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa0], 0x4b0048
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0xa0]
mov eax, 0x101e5090
mov dword [ebp - 0x9c], 0x590045
push edi
mov dword [ebp - 0x98], 0x43005f
mov edx, 0x4d
mov dword [ebp - 0x94], 0x520055
sub esi, eax
mov dword [ebp - 0x90], 0x450052
mov dword [ebp - 0x8c], 0x54004e
mov dword [ebp - 0x88], 0x55005f
mov dword [ebp - 0x84], 0x450053
mov dword [ebp - 0x80], 0x5c0052
mov dword [ebp - 0x7c], 0x4f0053
mov dword [ebp - 0x78], 0x540046
mov dword [ebp - 0x74], 0x410057
mov dword [ebp - 0x70], 0x450052
mov dword [ebp - 0x6c], 0x4d005c
mov dword [ebp - 0x68], 0x630069
mov dword [ebp - 0x64], 0x6f0072
mov dword [ebp - 0x60], 0x6f0073
mov dword [ebp - 0x5c], 0x740066
mov dword [ebp - 0x58], 0x57005c
mov dword [ebp - 0x54], 0x6e0069
mov dword [ebp - 0x50], 0x6f0064
mov dword [ebp - 0x4c], 0x730077
mov dword [ebp - 0x48], 0x43005c
mov dword [ebp - 0x44], 0x720075
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x74006e
mov dword [ebp - 0x38], 0x650056
mov dword [ebp - 0x34], 0x730072
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6e0055
mov dword [ebp - 0x24], 0x6e0069
mov dword [ebp - 0x20], 0x740073
mov dword [ebp - 0x1c], 0x6c0061
mov dword [ebp - 0x18], 0x5c006c
mov dword [ebp - 0x14], 0x650057
mov dword [ebp - 0x10], 0x680043
mov dword [ebp - 0xc], 0x740061
lea ecx, [edx + 0x7fffffb1]
test ecx, ecx
je 0x1003aa9e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1003aa9e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1003aa80
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret