joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454e40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0xc
test eax, eax
je 0x454f71
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
cmp eax, 4
jb 0x454e79
mov edi, eax
shr edi, 2
mov ecx, dword [esi]
sub eax, 4
xor dword [edx], ecx
add esi, 4
add edx, 4
sub edi, 1
jne 0x454e63
mov dword [esp + 0x20], eax
push ebx
xor ebx, ebx
test eax, eax
je 0x454f6e
cmp eax, 8
jb 0x454f52
lea ecx, [esi - 1]
lea edi, [edx - 1]
add ecx, eax
add edi, eax
cmp edx, ecx
ja 0x454ea3
cmp edi, esi
jae 0x454f52
push ebp
cmp eax, 0x40
jb 0x454f25
mov ebp, eax
lea edi, [esi + 0x30]
and ebp, 0x3f
mov ecx, eax
sub ecx, ebp
mov dword [esp + 0x10], ebp
mov ebp, esi
mov dword [esp + 0x18], ecx
sub ebp, edx
lea ecx, [edx + 0x10]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
movups xmm0, xmmword [ecx - 0x10]
add ebx, 0x40
lea edi, [edi + 0x40]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [edi - 0x70]
xorps xmm1, xmm0
movups xmmword [ecx - 0x50], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [eax + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x40], xmm1
movups xmm0, xmmword [ecx - 0x30]
movups xmm1, xmmword [edi - 0x50]
xorps xmm1, xmm0
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [ecx - 0x20]
movups xmm0, xmmword [edi - 0x40]
xorps xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp ebx, dword [esp + 0x18]
jb 0x454ed0
mov eax, dword [esp + 0x28]
cmp ebp, 8
jb 0x454f4d
mov edi, eax
lea ecx, [ebx + edx]
mov ebp, esi
and edi, 0xfffffff8
sub ebp, edx
movq xmm1, qword [ecx + ebp]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebx, 8
xorps xmm1, xmm0
movq qword [ecx - 8], xmm1
cmp ebx, edi
jb 0x454f31
pop ebp
cmp ebx, eax
jae 0x454f6e
sub esi, edx
lea edi, [ebx + edx]
sub eax, ebx
nop dword [eax]
mov cl, byte [esi + edi]
lea edi, [edi + 1]
xor byte [edi - 1], cl
sub eax, 1
jne 0x454f60
pop ebx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4a6a40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
sub esp, 0x10
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
test edx, edx
je 0x4a6baa
push ebx
push edi
mov edi, dword [esp + 0x24]
cmp edx, 2
jb 0x4a6b87
lea eax, [edx*4 - 4]
add eax, ebp
lea ebx, [edx - 1]
lea ebx, [edi + ebx*4]
cmp edi, eax
ja 0x4a6a85
cmp ebx, ebp
jae 0x4a6b87
lea eax, [edx - 1]
lea eax, [esi + eax*4]
cmp edi, eax
ja 0x4a6a97
cmp ebx, esi
jae 0x4a6b87
cmp edx, 0x10
jb 0x4a6b38
mov eax, edx
mov ebx, edx
and eax, 0xf
mov edx, edi
sub ebx, eax
mov dword [esp + 0x1c], eax
sub edx, ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], edx
lea eax, [ebp + 0x10]
mov ebx, esi
mov edx, esi
sub ebx, ebp
mov ebp, dword [esp + 0x10]
sub edx, edi
mov dword [esp + 0x14], edx
lea edx, [edi + 0x20]
nop
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [esp + 0x14]
lea eax, [eax + 0x40]
movups xmm1, xmmword [esi + ecx*4]
lea edx, [edx + 0x40]
xorps xmm1, xmm0
movups xmmword [edx - 0x60], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax + ebp - 0x40], xmm1
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [esp + 0x24]
movups xmm0, xmmword [eax - 0x30]
xorps xmm1, xmm0
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx*4 + 0x30]
add ecx, 0x10
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [esp + 0x18]
jb 0x4a6ad0
cmp dword [esp + 0x1c], 2
mov edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
jb 0x4a6b83
jmp 0x4a6b3c
mov ebx, esi
sub ebx, ebp
mov eax, edx
and eax, 0xfffffffe
mov dword [esp + 0x1c], eax
lea eax, [ecx*4]
add eax, ebp
sub edi, ebp
mov dword [esp + 0x30], edi
nop dword [eax]
nop dword [eax + eax]
movq xmm1, qword [ebx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 2
xorps xmm1, xmm0
movq qword [edi + eax - 8], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x4a6b60
mov edi, dword [esp + 0x24]
cmp ecx, edx
jae 0x4a6ba8
lea eax, [ecx*4]
sub esi, ebp
add eax, ebp
sub edi, ebp
sub edx, ecx
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x4a6b96
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x4acd80
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1eed
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5116c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x4acdf6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x4acdf6
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x4ace14
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418035
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.0040f350
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.004acf10
push 0x50d800
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x4ad350
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1fd9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5116c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x520eac]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x522858]
cmp eax, dword [ecx + 4]
jg 0x4ad3c8
push esi
push dword [ebp + 0xc]
push dword [0x522854]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4ad40f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418035
mov esp, ebp
pop ebp
ret 8
push 0x522858
call fcn.004188c7
add esp, 4
cmp dword [0x522858], 0xffffffff
jne 0x4ad398
mov ecx, 0x522854
mov dword [ebp - 4], 0
call fcn.004acd80
push 0x4d2b50
call fcn.004184eb
push 0x522858
mov dword [ebp - 4], 0xffffffff
call fcn.00418876
add esp, 8
jmp 0x4ad398
push 0x4eb278
lea ecx, [ebp - 0x28]
call fcn.0040f350
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.004acf10
push 0x50d800
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4ad440
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2021
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5116c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x58]
push 1
call fcn.0041aa30
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x58], vtable.CryptoPP::NonblockingRng.0
call fcn.004acd80
mov eax, dword fs:[0x2c]
mov ecx, dword [0x520eac]
mov dword [ebp - 4], 0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x522858]
cmp eax, dword [ecx + 4]
jg 0x4ad4ed
push esi
push dword [ebp + 0x10]
push dword [0x522854]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4ad531
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], vtable.CryptoPP::NonblockingRng.0
test eax, eax
je 0x4ad4d3
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418035
mov esp, ebp
pop ebp
ret
push 0x522858
call fcn.004188c7
add esp, 4
cmp dword [0x522858], 0xffffffff
jne 0x4ad4a8
mov ecx, 0x522854
mov byte [ebp - 4], 1
call fcn.004acd80
push 0x4d2b50
call fcn.004184eb
push 0x522858
mov byte [ebp - 4], 0
call fcn.00418876
add esp, 8
jmp 0x4ad4a8
push 0x4eb278
lea ecx, [ebp - 0x28]
call fcn.0040f350
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x50]
call fcn.004acf10
push 0x50d800
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x4add80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov eax, ecx
mov edx, dword [esp + 0xc]
add eax, eax
lea ecx, [ecx*4 - 4]
movups xmm0, xmmword [edx + eax*8]
movups xmm1, xmmword [edx]
movups xmmword [edx], xmm0
movups xmmword [edx + eax*8], xmm1
mov eax, 4
mov dword [esp], eax
cmp ecx, eax
jbe 0x4ade11
push esi
push edi
mov edi, 0x10
lea esi, [ecx*4]
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], esi
nop word [eax + eax]
mov eax, dword [esp + 0x18]
lea edi, [edi + 0x10]
aesimc xmm0, xmmword [esi + edx]
aesimc xmm1, xmmword [edi + edx - 0x10]
add dword [esp + 0x18], 0x10
lea esi, [esi - 0x10]
movups xmmword [eax + edx], xmm0
sub ecx, 4
mov eax, dword [esp + 0xc]
sub dword [esp + 0xc], 0x10
movups xmmword [eax + edx], xmm1
mov eax, dword [esp + 8]
add eax, 4
mov dword [esp + 8], eax
cmp eax, ecx
jb 0x4addd0
pop edi
pop esi
aesimc xmm0, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
add esp, 8
ret
Function at 0x401000
Capabilities:
Enumerate processes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x401060
mov esi, eax
lea edi, [esp + 4]
push 0x124
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [edi - 4], 0x128
mov edi, esp
push edi
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401059
mov ebx, dword [esp + 0x138]
cmp dword [esp + 8], ebx
je 0x40106c
push edi
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401048
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x128
pop esi
pop edi
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x401062

Function at 0x401077
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, esp
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4010e6
xorps xmm0, xmm0
lea eax, [esp + 0xc]
movups xmmword [eax - 4], xmm0
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4010e6
lea eax, [esp + 0x18]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
lea ecx, [esp + 8]
mov dword [ecx], 1
mov dword [ecx + 0xc], 2
lea edx, [esp + 4]
push edx
push eax
push 0x10
push ecx
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x28
ret
Function at 0x402596
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x402fd0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [edx + 0x10]
cmp dword [edx + 0x14], 8
mov ecx, edx
jb 0x4025d5
mov ecx, dword [edx]
mov esi, 0x811c9dc5
add eax, eax
je 0x4025f1
xor edx, edx
movzx edi, byte [ecx + edx]
xor edi, esi
imul esi, edi, 0x1000193
inc edx
cmp eax, edx
jne 0x4025e0
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push edi
call fcn.00402710
mov eax, dword [edi + 4]
test eax, eax
je 0x402616
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x4026dc
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0x4924924
mov dword [ebp - 0x10], 0xffffffff
je 0x4026f1
mov esi, dword [ebp - 0x20]
lea eax, [esi + 4]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0xc]
push eax
call fcn.00402766
mov eax, dword [esi + 8]
inc eax
movq xmm0, qword [0x404030]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [esi + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [esi]
jbe 0x4026ae
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x20]
call fcn.00402846
mov eax, dword [ebp - 0x28]
add eax, 8
lea esi, [ebp - 0x3c]
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
push edi
push eax
push esi
call fcn.00402710
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
jmp 0x4026b4
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x2c]
mov edx, dword [esi + 4]
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0x20]
push edx
push eax
push edi
call fcn.004028d8
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov byte [ebx + 4], 1
mov ecx, esi
call fcn.00402928
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
nop
push ebp
sub esp, 0xc
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00402928
add esp, 0xc
pop ebp
ret
Function at 0x402a24
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x28]
cmp eax, 0x10000001
jae 0x402bba
mov ebp, ecx
dec eax
or eax, 1
bsr ecx, eax
xor ecx, 0x1f
neg cl
xor esi, esi
inc esi
shl esi, cl
lea eax, [ebp + 0xc]
mov edi, dword [ebp + 4]
mov edx, 2
shl edx, cl
mov ecx, eax
push edi
push edx
call fcn.00402498
lea eax, [esi - 1]
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp + 4]
mov eax, dword [eax]
mov dword [esp + 0x10], edi
cmp eax, edi
je 0x402bb0
mov dword [esp + 8], ebp
mov ecx, eax
lea edi, [eax + 8]
cmp dword [eax + 0x1c], 8
mov eax, edi
jb 0x402a91
mov eax, dword [ecx + 8]
mov dword [esp], ecx
mov edx, dword [ecx + 0x18]
mov ecx, 0x811c9dc5
add edx, edx
je 0x402ab3
xor esi, esi
movzx ebx, byte [eax + esi]
xor ebx, ecx
imul ecx, ebx, 0x1000193
inc esi
cmp edx, esi
jne 0x402aa2
mov edx, dword [esp]
mov eax, dword [edx]
mov dword [esp + 4], eax
and ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
lea esi, [ecx + ecx]
lea ebp, [ecx*2 + 1]
mov eax, dword [esp + 0x10]
cmp dword [ebx + ecx*8], eax
je 0x402b6c
mov dword [esp + 0xc], ebp
mov ebp, dword [ebx + ebp*4]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040295a
test al, al
je 0x402b2f
mov eax, dword [ebp]
mov ecx, dword [esp]
cmp eax, ecx
je 0x402b1e
mov ecx, dword [ecx + 4]
mov ebp, dword [esp + 4]
mov dword [ecx], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov esi, dword [eax + 4]
mov edi, dword [esp]
mov dword [esi], edi
mov dword [eax + 4], edx
mov dword [ebp + 4], ecx
mov eax, dword [esp]
mov dword [eax + 4], esi
mov ecx, dword [esp]
mov eax, dword [esp + 0xc]
mov dword [ebx + eax*4], ecx
mov ebp, dword [esp + 8]
mov eax, dword [esp + 4]
jmp 0x402ba6
cmp dword [ebx + esi*4], ebp
je 0x402b78
mov ebp, dword [ebp + 4]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040295a
test al, al
je 0x402b2f
mov eax, dword [ebp]
mov edi, dword [esp]
mov ecx, dword [edi + 4]
mov ebx, dword [esp + 4]
mov dword [ecx], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov esi, dword [eax + 4]
mov dword [esi], edi
mov dword [eax + 4], edx
mov eax, ebx
mov dword [ebx + 4], ecx
mov dword [edi + 4], esi
jmp 0x402ba2
mov dword [ebx + esi*4], edx
mov dword [ebx + ebp*4], edx
mov eax, dword [esp + 4]
jmp 0x402ba2
mov edi, dword [esp]
mov ecx, dword [edi + 4]
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], ebp
mov edx, dword [ebp + 4]
mov dword [edx], edi
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov dword [ebx + esi*4], edi
mov ebp, dword [esp + 8]
cmp eax, dword [esp + 0x10]
jne 0x402a81
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
Function at 0x402bc4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
mov esi, eax
jb 0x402bdc
mov esi, dword [eax]
mov edi, 0x811c9dc5
add edx, edx
je 0x402bf8
xor ebx, ebx
movzx ebp, byte [esi + ebx]
xor ebp, edi
imul edi, ebp, 0x1000193
inc ebx
cmp edx, ebx
jne 0x402be7
mov esi, esp
push edi
push eax
push esi
call fcn.00402710
cmp dword [esi + 4], 0
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x402c14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x10]
cmp dword [eax + 0x14], 8
mov esi, eax
jb 0x402c2c
mov esi, dword [eax]
mov edi, 0x811c9dc5
add edx, edx
je 0x402c48
xor ebx, ebx
movzx ebp, byte [esi + ebx]
xor ebp, edi
imul edi, ebp, 0x1000193
inc ebx
cmp edx, ebx
jne 0x402c37
mov esi, esp
push edi
push eax
push esi
call fcn.00402710
mov eax, dword [esi + 4]
test eax, eax
je 0x402c66
add eax, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__

Function at 0x40373e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40377d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40377d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40377d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40377d
cmp dword [ecx + 0x74], 0xe
jbe 0x40377d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x403630
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403645
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403684
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403680
lea ebx, [ebx]
cmp esi, edx
jae 0x403684
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x403670
cmp esi, edx
jb 0x403689
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x403800
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5453d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5ad6a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5aeb40], 0
mov dword [ebp - 4], 1
je 0x40387c
push dword [0x5aeb44]
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov esi, esp
push eax
call fcn.00401220
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov esi, esp
push eax
mov byte [ebp - 4], 2
call fcn.00401220
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 1
call dword [0x5aeb40]
add esp, 0xc
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401220
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00403e60
add esp, 4
cmp eax, 1
jne 0x4038d6
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401220
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404c00
add esp, 4
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4038e1
or esi, 0xffffffff
jmp 0x403902
test eax, eax
jns 0x4038bf
mov esi, 0xfffffffe
jmp 0x403902
mov eax, dword [ebp + 0xc]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.00401220
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404c00
add esp, 4
xor esi, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x403925
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x403946
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403cf0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5454b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5ad6a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 4], 0
call fcn.00401220
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00404c00
add esp, 4
cmp dword [0x5aeb48], 0
je 0x403d84
push dword [0x5aeb4c]
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push 0x556d00
call fcn.00401ed0
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov byte [ebp - 4], 1
call fcn.00401220
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [ebp - 4], 0
call dword [0x5aeb48]
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, dword [ebp + 8]
neg eax
sbb esi, esi
add edi, 0xfffffff0
neg esi
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403db7
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
call edi
cmp eax, 0xffffffff
jne 0x403e19
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, edi
call ebx
cmp eax, 2
je 0x403e32
cmp eax, 3
je 0x403e32
cmp eax, 5
jne 0x403e2b
cmp esi, 0x14
jge 0x403e24
push 0x32
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
je 0x403df0
test al, 0x10
je 0x403e36
mov esi, 1
jmp 0x403e39
mov esi, 0xffffff9e
jmp 0x403e39
mov esi, 0xffffff9d
jmp 0x403e39
xor esi, esi
jmp 0x403e39
or esi, 0xffffffff
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403e56
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret