joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bded
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x148
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, ecx
mov dword [ebp - 0x14], esi
test edi, edi
jne 0x10058c0c
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10058d8b
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push edi
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push edi
call fcn.10007ada
cmp dword [ebp - 0x1c], 0xf
lea eax, [esi + 0x14]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x18], eax
cmova esi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
jbe 0x10058c67
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x20]
jb 0x10058c52
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.1005b620
mov esi, dword [eax + 4]
test esi, esi
jne 0x10058c84
mov esi, dword [ebp - 0x14]
mov esi, dword [esi + 0x18]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x10058cb8
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10058cae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10058da0
push ecx
push edx
call fcn.1007b4aa
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp esi, dword [eax + 0x18]
jne 0x10058d86
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push edi
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x48]
push eax
push edi
call fcn.10007ada
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x10058d46
push edi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..dll
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x10058d46
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x48]
push eax
call fcn.10059af0
mov dword [eax], esi
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10058d89
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10058d7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10058da5
push ecx
push edx
call fcn.1007b4aa
add esp, 8
jmp 0x10058d89
mov esi, dword [esi + 0x20]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.1007c500
call fcn.1007c500
int3
Function at 0x10058db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x20], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x14]
push 0
push 4
push eax
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push esi
call edi
push 4
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push eax
call edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x40
push dword [esp + 0x2c]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call ebp
push eax
call ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
lea eax, [ebx + 4]
pop ebx
add esp, 8
ret 0xc
Function at 0x10058e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008be0d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov dword [ebp - 0x10], ecx
call fcn.1007b04b
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.MemoryAllocator.0
test esi, esi
je 0x10058eb3
and esi, 0xfffff000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 4], 0
push 0x40
push 0x3000
push 0x200
add esi, 0x1000
push esi
call ebx
mov dword [edi + 4], eax
test eax, eax
je 0x10058ec0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 8]
mov dword [ebp - 0x18], edi
cmp eax, dword [ecx + 8]
je 0x10058ef5
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x10058eff
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.1005b4c0
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [edi + 4]
imul ecx, eax, 0x1000193
movzx eax, dh
mov dword [ebp - 0x18], edx
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebx + 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1005b450
mov eax, dword [eax + 4]
test eax, eax
jne 0x10058f54
mov eax, dword [ebx + 0x38]
cmp eax, dword [ebx + 0x38]
je 0x10058f5e
add eax, 0xc
jne 0x10058fab
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x34]
call fcn.10059990
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x10058f98
push 0
push 0
mov ecx, eax
call fcn.1005a440
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x34]
call fcn.10059990
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], esi
cmp ecx, dword [eax + 8]
je 0x10058fbe
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x10058fca
lea edx, [ebp - 0x18]
push edx
push ecx
mov ecx, eax
call fcn.1005b4c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10059780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push ebp
mov ebp, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
push esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebp + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1005b450
mov eax, dword [eax + 4]
test eax, eax
jne 0x100597e8
mov eax, dword [ebp + 0x38]
xor ebx, ebx
lea ecx, [eax + 0xc]
cmp eax, dword [ebp + 0x38]
cmovne ebx, ecx
test ebx, ebx
jne 0x10059802
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov eax, dword [ebx + 4]
cmp dword [ebx], eax
je 0x100598ba
push edi
nop
mov edi, dword [eax - 4]
lea eax, [esp + 0x10]
push eax
push 0x40
mov dword [esp + 0x18], 0
mov esi, dword [edi]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push esi
lea eax, [edi + 4]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x100598a8
mov ecx, dword [esi]
cmp dword [ecx + 4], edi
je 0x10059887
add esi, 4
cmp esi, eax
jne 0x10059877
jmp 0x100598a8
test ecx, ecx
je 0x10059891
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 4]
sub eax, ecx
push eax
push ecx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
add dword [ebp + 0xc], 0xfffffffc
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
mov dword [ebx + 4], eax
cmp dword [ebx], eax
jne 0x10059810
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x10059bc0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
cmp edx, eax
je 0x10059d4c
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [edx + 0xa]
mov esi, edx
imul ecx, ecx, 0x1000193
push edi
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebx + eax*8]
mov dword [esp + 0x18], ecx
lea eax, [ebx + eax*8]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059930
push 0x18
push edi
call fcn.1007b4aa
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x10059c91
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x10059c40
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x10059d40
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x2c]
jne 0x10059ca9
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [edx], eax
jmp 0x10059cad
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10059d40
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059930
push 0x18
push edi
call fcn.1007b4aa
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x20]
je 0x10059d53
cmp esi, eax
jne 0x10059d10
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10059cc0
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x10059d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x10059f25
cmp dword [ebx + 0x1c], 0xf
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
push esi
mov dword [esp + 0x2c], eax
lea esi, [ebx + 8]
jbe 0x10059dba
mov esi, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x18], ecx
jbe 0x10059dd8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x18]
jb 0x10059dc6
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov esi, dword [ebx]
mov edx, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.1005ab60
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
je 0x10059e25
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x10059e37
mov edx, esi
mov esi, dword [esi]
call fcn.1005ab60
dec dword [edi + 8]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x24], eax
jne 0x10059e07
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x10059e5c
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x10059e60
cmp dword [esp + 0x18], ebx
jne 0x10059f1b
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x10059f1b
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov dword [esp + 0x14], esi
jbe 0x10059e80
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x10059ea9
mov ebp, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x10059e94
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov ebx, dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
mov edx, esi
mov dword [esp + 0x18], eax
mov esi, dword [esi]
mov dword [esp + 0x24], ebx
call fcn.1005ab60
dec dword [edi + 8]
cmp dword [esp + 0x14], ebx
je 0x10059eeb
mov ebx, esi
cmp esi, ebp
je 0x10059f15
mov edx, esi
mov esi, dword [esi]
call fcn.1005ab60
dec dword [edi + 8]
cmp ebx, dword [esp + 0x24]
jne 0x10059ed3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, ebp
jne 0x10059e70
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x1005abd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x1005abf9
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1005abe8
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x1005b110
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1005b265
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10059f30
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1005b23f
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebp]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x1005b1c5
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1005b232
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1005b1ff
mov edx, dword [edx]
mov dword [esp + 0x14], edx
cmp edx, eax
je 0x1005b1fa
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1005b22e
cmp edi, edx
je 0x1005b20f
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1005b249
cmp edi, edx
jne 0x1005b203
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x1005b171
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1005b22e
push str.invalid_hash_bucket_count
call fcn.10079a72
int3
Function at 0x1006e2c0
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
mov dword [0x100e6480], eax
mov word [0x100e6484], ax
movzx eax, cl
lea ecx, [ecx + ecx*2]
imul eax, eax, 0xd
add ecx, ecx
push ebx
push esi
mov bl, al
mov dword [esp + 8], eax
xor bl, 0x6e
xor eax, eax
sub ecx, 0x100e6480
lea esi, [ecx + 0x100ae4f8]
mov dl, byte [esi + eax + 0x100e6480]
mov cl, dl
add dl, byte [esp + 8]
xor cl, bl
add dl, al
mov byte [eax + 0x100e6480], cl
add bl, dl
inc eax
cmp eax, 6
jl 0x1006e2f2
pop esi
pop ebx
mov eax, 0x100e6480
pop ecx
ret

Function at 0x100715b0
Capabilities:
Encode data using xor

Disassembly:
push esi
xorps xmm0, xmm0
lea edx, [ecx + 0x100c97a8]
mov esi, 0x100e649c
movups xmmword [0x100e649c], xmm0
sub esi, ecx
movups xmmword [0x100e64ac], xmm0
nop
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
xor al, 0x6e
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x100715d0
pop esi
mov eax, 0x100e649c
ret

Function at 0x1007356b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x100735d6
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0a8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0a8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0a8]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0a8]
sub edi, 1
jne 0x1007357f
pop edi
test esi, esi
je 0x100735f2
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0a8]
inc edx
sub esi, 1
jne 0x100735da
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x100793df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x100c9040]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x1007940c
or eax, 0xffffffff
jmp 0x100794fa
cmp dword [esi + 0x14], 1
je 0x1007941a
push 0xfffffffffffffffc
pop eax
jmp 0x100794fa
cmp edi, dword [esi + 0x10]
jb 0x10079423
push 0xfffffffffffffff6
jmp 0x10079414
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
add eax, dword [ecx]
jne 0x10079434
push 0xfffffffffffffff5
jmp 0x10079414
movzx ebx, word [eax + 0x1c]
add eax, 0x2e
cmp dword [esi + 0x5c], 0
mov dword [esp + 0xc], eax
je 0x10079457
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 0x5c], 0
mov eax, dword [esp + 0x10]
pop ecx
push ecx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.1007929a
mov dword [esi + 0x5c], eax
pop ecx
pop ecx
test eax, eax
jne 0x1007946f
push 0xfffffffffffffffe
jmp 0x10079414
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.1007926a
pop ecx
test eax, eax
jne 0x10079486
push 0xfffffffffffffffd
jmp 0x10079414
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0xa0], eax
mov ax, word [esp + 0x26]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x4e010], eax
xor eax, eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x4e014], ecx
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007b975
mov esp, ebp
pop ebp
ret
Function at 0x1007c530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x100c9040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1007c557
mov ecx, 5
int 0x29
push 2
call fcn.1007c0a6
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1007c662
test esi, esi
jne 0x1007c662
push 2
call fcn.1007c0a6
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007b975
mov esp, ebp
pop ebp
ret