joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4381b5
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5c1c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.0042ce6f
pop ecx
cmp eax, esi
je 0x43829f
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x43829f
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.00526590
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x43829f
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x43829f
cmp esi, 0x14
jge 0x43829f
push 0x10
push 0
push edi
call fcn.00529160
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x43828e
call fcn.0052707e
cmp dword [eax], 0x22
je 0x43828e
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.00526d0c
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x438264
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x5c7110], 0
jne 0x43832a
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x438353
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.004380c5
pop ecx
pop ecx
test eax, eax
jne 0x438355
inc edi
cmp edi, esi
jl 0x438330
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00523519
leave
ret 8
Function at 0x439363
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4393ab
call fcn.0042a861
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4393ab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4393ee
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4393d7
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4393d7
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x4393eb
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43dad2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5c1c00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x43db07
xor eax, eax
jmp 0x43db5a
lea eax, [ebp - 0x210]
push eax
call fcn.00526d0c
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x43db38
push 0x5747f0
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00529f1f
add esp, 0xc
test eax, eax
jne 0x43db03
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00529f1f
add esp, 0xc
test eax, eax
jne 0x43db03
lea eax, [ebp - 0x210]
push eax
call fcn.0042cef5
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00523519
leave
ret

Function at 0x492d21
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x492d3b
call fcn.0042a861
mov esi, dword [eax + 0xc]
push dword [0x5c8ef4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x492d59
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x492d51
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x492d86
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x492d53
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00492c4f
mov esi, eax
jmp 0x492d78
Function at 0x509d08
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x509d20
mov edi, dword [esi + 0xc]
jmp 0x509d60
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x509d39
call fcn.00425898
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x509d4e
call fcn.00425898
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x509d60
call fcn.00425898
call fcn.0042a861
cmp dword [eax + 0x3c], 0
je 0x509d75
push edi
mov ecx, ebx
call fcn.00508b3c
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.00509c22
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x509d93
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x509d9f
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x523519
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c1c00]
jne 0x523523
repz ret
jmp fcn.0052c1b4
Function at 0x53a61e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c1c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052ed38
and dword [ebp - 0x14], 0
cmp dword [0x5cb848], 0
mov dword [ebp - 0x18], eax
jne 0x53a6d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x53a779
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x53a779
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5978dc
push ebx
mov dword [0x5cb848], eax
call edi
push eax
call esi
push 0x5978c8
push ebx
mov dword [0x5cb84c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5cb850], eax
call edi
push eax
call esi
mov dword [0x5cb858], eax
test eax, eax
je 0x53a6d1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5cb854], eax
mov eax, dword [0x5cb854]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x53a72a
cmp dword [0x5cb858], ecx
je 0x53a72a
push eax
call esi
push dword [0x5cb858]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x53a72a
test ebx, ebx
je 0x53a72a
call edi
test eax, eax
je 0x53a721
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53a721
test byte [ebp - 8], 1
jne 0x53a72a
or dword [ebp + 0x10], 0x200000
jmp 0x53a75d
mov eax, dword [0x5cb84c]
cmp eax, dword [ebp - 0x18]
je 0x53a75d
push eax
call esi
test eax, eax
je 0x53a75d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x53a75d
mov eax, dword [0x5cb850]
cmp eax, dword [ebp - 0x18]
je 0x53a75d
push eax
call esi
test eax, eax
je 0x53a75d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5cb848]
call esi
test eax, eax
je 0x53a779
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x53a77b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00523519
leave
ret
Function at 0x5572f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x5572ff
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x5c390c]
test eax, eax
je 0x55730d
call fcn.005571a0
mov edx, dword [esp + 0x10]
cmp edx, 8
mov eax, dword [esp + 8]
not eax
jb 0x557401
push ebx
push edi
mov edi, edx
shr edi, 3
xor ecx, ecx
mov cl, byte [esi]
mov ebx, eax
shr ebx, 8
sub edx, 8
xor ecx, eax
and ecx, 0xff
mov eax, dword [ecx*4 + 0x5cbc10]
xor eax, ebx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cbc10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x5cbc10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cbc10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x5cbc10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cbc10]
shr eax, 8
xor ecx, eax
xor eax, eax
mov al, byte [esi + 1]
inc esi
xor eax, ecx
and eax, 0xff
mov eax, dword [eax*4 + 0x5cbc10]
shr ecx, 8
xor eax, ecx
xor ecx, ecx
mov cl, byte [esi + 1]
inc esi
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cbc10]
shr eax, 8
xor eax, ecx
inc esi
dec edi
jne 0x557327
pop edi
pop ebx
test edx, edx
je 0x557421
xor ecx, ecx
mov cl, byte [esi]
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5cbc10]
shr eax, 8
xor eax, ecx
inc esi
dec edx
jne 0x557405
not eax
pop esi
ret 0xc
Function at 0x40b57d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x410920
cmp edx, dword [eax]
je 0x40b59f
add eax, 8
inc ecx
cmp eax, 0x4109b0
jl 0x40b590
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x410920]
jne 0x40b6cd
mov eax, dword [0xf0f8b4]
cmp eax, 1
je 0x40b6a7
test eax, eax
jne 0x40b5d0
cmp dword [0x410248], 1
je 0x40b6a7
cmp edx, 0xfc
je 0x40b6cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b607
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004088e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408ab0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b64a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408ab0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40f48c
push edi
call fcn.00409000
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004088e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004088f0
lea eax, [ebp - 0xa0]
push 0x40f46c
push eax
call fcn.004088f0
push dword [esi + 0x410924]
lea eax, [ebp - 0xa0]
push eax
call fcn.004088f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d753
add esp, 0x2c
pop edi
jmp 0x40b6cd
lea eax, [ebp + 8]
lea esi, [esi + 0x410924]
push 0
push eax
push dword [esi]
call fcn.00408ab0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x154cb45
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 0xc]
jne 0x2598da4
lea eax, [esi + 0x7c9e94a2]
lea eax, [ecx - 0x730fe559]
cwde
mov eax, dword [edx + 8]
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.0259acaa
movzx esi, word [edx + 0x1a]
not di
movsx di, dl
lea esi, [esi + edx + 0x1c]
movsx di, bl
mov edi, dword [ebp + 8]
pushal
pushal
mov byte [esp + 8], ah
call fcn.0154b3ea
jmp dword [sym.imp.KERNEL32.dll_GetVersion]
test bl, 0x60
cmc
test cl, ah
cmp cx, 0xc6da
add ecx, 0xffffffff
jmp 0x27ed42b
bt dx, 0xf
xor eax, eax
push esi
pushal
pushal
lea esp, [esp + 0x44]
je 0x259aca3
pushal
cmc
cmc
add edx, 0x11c
push esi
mov byte [esp + 8], ch
lea esp, [esp + 0x24]
jmp 0x2801751
lea esi, [esp - 0x1aabd4b1]
movzx di, al
jmp 0x154cc7b

Function at 0x154cb6a
Capabilities:
Check os version

Disassembly:
sti
mov ebp, 0x3d9eff6d
sti
jb 0x154cace
mov esi, dword [edi + 0x57]
dec ebp
enter 0x505, 0xffffffffffffff80
add ecx, esp
mov ebx, 0xd9c66acb
fcmovb st(0), st(0)
invalid
xor al, 0xf1
push ds
jg 0x154ca6c
into
push edi
xor dword [eax - 0x7b48bf66], ebp
and eax, dword [ecx - 0x57]
xor byte [ebx - 0x66], 0x11
lcall 0x7d7c, 0xaee0141
cmp edi, 0xffffffd9
xchg ecx, eax
cmp byte [ebx], al
push 0x68
les ebp, [ecx - 0x53896067]
std
pop ebx
imul ecx, edi, 2
add dl, al
movsb byte es:[edi], byte [esi]
invalid
invalid
xor dl, byte [edi - 3]
jae 0x154cab2
lcall 0x7cd4, 0x3851fe77
test eax, 0x1dcaaaf
jg 0x154cb46
rcr byte [ebp + edx - 0x36], 0x13
enter 0xffffffffffff8ab5, 0x39
and al, 0xc
push dword [esp]
mov byte [esp], bh
lea esp, [esp + 0x10]
jne 0x154d3cc
pushal
call fcn.028032e1
xor dl, 0xdc
cmpsd dword [esi], dword es:[edi]
leave
add eax, 0x84489805
mov ebx, 0xffb2f44b
jo 0x154cc00
jecxz 0x154cb17
mov esi, 0x2d872989
insb byte es:[edi], dx
mov al, 0x66
mov al, 0x66
stc
invalid
dec edx
jne 0x154cb9a
js 0x154cc46
cmc
push esp
sbb byte [edi + 3], cl
dec esi
and bh, byte [ebx + 0x1d3b0d1c]
dec esp
and al, 0xf1
or eax, 0x244c1d3b
int1
inc edi
lahf
mov al, byte [0x6aec3a15]
lahf
pop edi
jnp 0x154cc0f
dec esi
mov ch, byte [ebp - 0x1e9f29c3]
cmpsb byte [esi], byte es:[edi]
mov bl, 0x96
into
ret 0x12ab
invalid

Function at 0x154d501
Capabilities:
Check os version

Disassembly:
push 0x4aa47137
lea edx, [ebx + 4]
mov word [esp], bp
push ecx
pushal
movzx esi, word [edx + 0x1a]
mov di, word [esp]
pushfd
lea esi, [esi + edx + 0x1c]
not di
movzx di, cl
bswap edi
mov edi, dword [ebp + 8]
pushfd
lea esp, [esp + 0x34]
call fcn.02807f92
pushfd
lea esp, [esp + 4]
jne 0x2598da4
call fcn.02807910
push dword [esp]
mov dword [esp + 0x44], 0x37393732
pushfd
pushfd
push edx
mov byte [esp], 0xed
lea esp, [esp + 0x50]
jmp 0x2811177

Function at 0x25990e0
Capabilities:
Encode data using xor

Disassembly:
push 0x6a1bf5e0
call fcn.02599862

Function at 0x2599862
Capabilities:
Check os version

Disassembly:
inc edi
mov byte [esp + 0xc], 0x4f
pushal
push edi
lea esp, [esp + 0x34]
jmp fcn.02807f92

Function at 0x27edbc6
Capabilities:
Check os version

Disassembly:
push dword [esp]
movzx esi, word [edx + 0x1a]
pushal
movzx di, al
movzx di, cl
lea esi, [esi + edx + 0x1c]
lea edi, [ecx*4 - 0xb6aecc5]
not di
mov edi, dword [ebp + 8]
jmp 0x28014f0
Function at 0x28014bd
Capabilities:
Check os version

Disassembly:
mov ah, 0xac
lea eax, [0x154a21f]
pushfd
mov dword [esp], 0x27ec8c1
push ecx
pushfd
call fcn.02808d14
cwde
mov dword [esp], 0xb
cwde
jmp 0x154d4e9

Function at 0x28014fe
Capabilities:
Check os version

Disassembly:
jmp 0x28078e3
push esp
pushfd
lea esp, [esp + 0x30]
call fcn.02807f92
pushal
mov word [esp + 8], dx
mov word [esp + 4], 0xc693
lea esp, [esp + 0x20]
jne 0x2598da4
call fcn.0154d78b
lea esp, [esp + 0x2c]
jo 0x154aaa4
push 0x280ce66
pushal
pushal
push dword [eax]
pop dword [esp + 0x3c]
push 0xe616f724
push dword [esp + 0x40]
ret 0x44
push cs
inc edx
sbb edi, dword [0xbf1f4130]
sar edx, 0x2d
popfd
and byte [ebx - 0x1a], ah
adc ah, byte [esi]
dec ebx
cmp edi, edi
push dword [esp]
lea esp, [esp + 0xc]
je 0x259aca3
movzx di, bl
lea edx, [ebx + 4]
push ecx
mov dword [esp], edi
pushfd
pushal
movzx esi, word [edx + 0x1a]
movsx di, al
movzx edi, cl
push dword [esp + 8]
mov word [esp], 0x8af6
lea esi, [esi + edx + 0x1c]
not di
not di
pop edi
mov edi, dword [ebp + 8]
jmp 0x27ec9b8
push 0x280ce66
call fcn.02808526
add byte [eax], al
add byte [eax], al
jo 0x2807947
add dword [eax + esi*2], edx
push esp
add dword [eax], ebx
jo 0x280794f
add dword [eax], ecx
jns 0x280787f
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp + ebp*8 - 0x80], bl
add al, byte [eax]
add byte [eax], al
invalid

Function at 0x2807893
Capabilities:
Check os version

Disassembly:
jmp 0x28078e3
push esp
pushfd
lea esp, [esp + 0x30]
call fcn.02807f92
pushal
mov word [esp + 8], dx
mov word [esp + 4], 0xc693
lea esp, [esp + 0x20]
jne 0x2598da4
call fcn.0154d78b
lea esp, [esp + 0x2c]
jo 0x154aaa4
push 0x280ce66
pushal
pushal
push dword [eax]
pop dword [esp + 0x3c]
push 0xe616f724
push dword [esp + 0x40]
ret 0x44
push cs
inc edx
sbb edi, dword [0xbf1f4130]
sar edx, 0x2d
popfd
and byte [ebx - 0x1a], ah
adc ah, byte [esi]
dec ebx
cmp edi, edi
push dword [esp]
lea esp, [esp + 0xc]
je 0x259aca3
movzx di, bl
lea edx, [ebx + 4]
push ecx
mov dword [esp], edi
pushfd
pushal
movzx esi, word [edx + 0x1a]
movsx di, al
movzx edi, cl
push dword [esp + 8]
mov word [esp], 0x8af6
lea esi, [esi + edx + 0x1c]
not di
not di
pop edi
mov edi, dword [ebp + 8]
jmp 0x27ec9b8
push 0x280ce66
call fcn.02808526
add byte [eax], al
add byte [eax], al
jo 0x2807947
add dword [eax + esi*2], edx
push esp
add dword [eax], ebx
jo 0x280794f
add dword [eax], ecx
jns 0x280787f
add al, byte [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp + ebp*8 - 0x80], bl
add al, byte [eax]
add byte [eax], al
invalid

Function at 0x280d96b
Capabilities:
Check os version

Disassembly:
pushfd
lea esp, [esp + 8]
jne 0x2598da4
push 0x621d5b1e
movsx eax, bl
pop eax
mov eax, dword [edx + 8]
pushfd
lea esp, [esp + 4]
jmp fcn.0259acaa
Function at 0x10039390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10121078], 0
push ebx
push esi
push edi
je 0x10039548
mov ecx, dword [0x1012b17c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10039548
mov esi, dword [0x1012b200]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039548
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x100393f7
push 0x410
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x10039411
push 0x272
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x10039427
xor edx, edx
test ecx, ecx
je 0x1003944d
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10039434
cmp edi, 0x5ff56dc5
je 0x1003945f
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10039548
mov esi, dword [ebp - 4]
jmp 0x100393d4
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x10039481
push 0x410
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x1003949b
push 0x272
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10039548
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039548
xor esi, esi
test eax, eax
jle 0x10039548
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp esi, dword [edi + 0x88]
jl 0x100394f5
push 0x410
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str.i___m_Size
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x10039515
push 0x272
push str.C:UsersmacioDesktop_bighake_mainutlvector.h
push str._IsReadOnly__
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + edx + 0x418]
ucomiss xmm0, dword [0x100c96ec]
lahf
test ah, 0x44
jp 0x10039539
mov dword [ecx + edx + 0x418], 0x7f7fffff
inc esi
add edx, 0x420
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 8]
jl 0x100394d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bcdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.1003b9e0
mov ecx, dword [0x1012b174]
test ecx, ecx
je 0x10039946
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x10039946
nop
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
xor ecx, ecx
mov dword [ebp - 0x28], eax
inc ecx
cmp byte [esi + ecx], 0
jne 0x100397f0
xor edx, edx
test ecx, ecx
je 0x10039811
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10039800
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
mov ebx, dword [ebp - 0x1c]
imul esi, eax, 0x1000193
mov ecx, ebx
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10037760
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10039935
cmp dword [ebx + 8], 0xfffffff
je 0x10039958
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
call fcn.100ba448
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [eax], ecx
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x100c9780]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9780]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10039918
mov ecx, ebx
call fcn.1003b350
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.10037760
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x1003991b
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
push ecx
push esi
mov ecx, ebx
call fcn.1003b2f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x100397e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3