joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468f28
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x468f94
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 8]
test eax, eax
je 0x468f8a
call fcn.0041fbf0
push 0
push 0
push 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 8]
push eax
call sub.user32.dll_PostThreadMessageA
push 0x1f4
mov eax, dword [ebx + 8]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x468f82
push 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
lea eax, [ebx + 8]
call fcn.0040ece0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x468f9e
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x46939c
Capabilities:
Check http status code
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x420], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x469523
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, esi
call fcn.00404bdc
test ebx, ebx
je 0x46950a
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0x469538
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x46950a
xor eax, eax
push ebp
push 0x469503
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4694d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, 0x84400000
push 0
push edi
push 0
push 0
mov eax, ebx
call fcn.0040506c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4694c9
mov dword [ebp - 0xc], 4
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_HttpQueryInfoA
cmp dword [ebp - 0x14], 0xc8
jne 0x4694c9
lea eax, [ebp - 8]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x4694c9
cmp dword [ebp - 8], 0
jbe 0x4694c9
lea edx, [ebp - 0x41c]
mov eax, esi
mov ecx, dword [ebp - 8]
call fcn.00404ccc
lea edx, [ebp - 0x420]
mov eax, dword [esi]
call fcn.0040942c
mov edx, dword [ebp - 0x420]
mov eax, esi
call fcn.00404c30
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4694dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46950a
cmp dword [ebp - 0x1c], 0
je 0x4694f9
mov eax, dword [ebp - 0x1c]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x18]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46952a
lea eax, [ebp - 0x420]
call fcn.00404bdc
ret
Function at 0x46a26c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x46a2c9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004032e4
test eax, eax
jle 0x46a2b3
lea edx, [ebp - 4]
mov eax, 1
call fcn.00403344
cmp dword [ebp - 4], 0
je 0x46a2b3
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040506c
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a2d0
lea eax, [ebp - 4]
call fcn.00404bdc
ret

Function at 0x46a7f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00405524
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x46a80e
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x46a82f
cmp ebx, 3
je 0x46a82f
cmp ebx, 0x7b
je 0x46a82f
mov eax, esi
call fcn.0046a7b8
test al, al
jne 0x46a833
xor eax, eax
jmp 0x46a835
mov al, 1
pop esi
pop ebx
ret

Function at 0x46a838
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00405524
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x46a85a
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x46aa40
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffdf8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405390
mov eax, esp
xor ecx, ecx
mov edx, 0x208
call fcn.00403614
push esp
push 0
push 0
push esi
push 0
call sub.shell32.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x46aa88
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004054f8
add esp, 0x208
pop esi
pop ebx
ret
Function at 0x46afa4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd88
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x274], edx
mov dword [ebp - 0x278], edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x26c], edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea esi, [ebp - 0x25c]
xor eax, eax
push ebp
push 0x46b18b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00405658
je 0x46b160
lea edx, [ebp - 0x260]
mov eax, ebx
call fcn.0046a9b4
mov edx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov ecx, 0x46b19c
call fcn.004055a0
mov eax, esi
xor ecx, ecx
mov edx, 0x250
call fcn.00403614
push esi
mov eax, dword [ebp - 4]
call fcn.00405524
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x46b160
xor edx, edx
push ebp
push 0x46b159
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x264]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.004054f8
mov eax, dword [ebp - 0x264]
call fcn.0046af68
test al, al
jne 0x46b130
mov eax, dword [esi]
test al, 2
jne 0x46b130
test al, 0x10
je 0x46b0d0
lea edx, [ebp - 0x268]
mov eax, ebx
call fcn.0046a9b4
mov eax, dword [ebp - 0x268]
push eax
lea eax, [ebp - 0x26c]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.004054f8
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 4]
pop edx
call fcn.004055a0
mov eax, dword [ebp - 4]
call fcn.0046afa4
lea eax, [ebp - 0x270]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.004054f8
mov eax, dword [ebp - 0x270]
call fcn.0046a860
test al, al
je 0x46b130
lea edx, [ebp - 0x274]
mov eax, ebx
call fcn.0046a9b4
mov eax, dword [ebp - 0x274]
push eax
lea eax, [ebp - 0x278]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.004054f8
mov ecx, dword [ebp - 0x278]
lea eax, [ebp - 8]
pop edx
call fcn.004055a0
mov eax, dword [ebp - 8]
call fcn.0046aa94
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x46b05e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b160
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b192
lea eax, [ebp - 0x278]
mov edx, 7
call fcn.004053a8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053a8
ret
Function at 0x10002762
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x10002797
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x10002794
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x100027a0
add edx, 0x28
cmp edx, esi
jne 0x10002782
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1000279d

Function at 0x10004072
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100040b1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100040b1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100040b1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100040b1
cmp dword [ecx + 0x74], 0xe
jbe 0x100040b1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10005fa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10005fcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10005fcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10008e94
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10008f31
push ebx
push esi
call fcn.10008f34
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008d9a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10008ede
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008f30
push edi
push eax
call fcn.10009010
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10008efe
call fcn.10007750
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10008f2f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008d9a
add esp, 0x20
test eax, eax
jne 0x10008f1d
push edi
call fcn.10007750
jmp 0x10008f25
push ebx
call fcn.10007750
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0xac4980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0xaeb01c]
push edi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x560033d
nop
push eax
nop
call 0x776c5da0
mov ebx, eax
push 0xaf4fb0
mov dword [ebp - 4], ebx
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
mov byte [ebx + edi], 0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0xac4a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x766c97f0
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0xaf4fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0xac4a26
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
push 0xaf4fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x5600343
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xac6e30
Capabilities:
Parse pe header

Disassembly:
cmp dword [ebx + 4], 0x40
jb 0xac6ed1
mov eax, dword [ebx]
push 0x40
push eax
push esi
nop
call 0x766c8cf0
mov ecx, 0x5a4d
add esp, 0xc
cmp word [esi], cx
jne 0xac6f00
mov eax, dword [esi + 0x3c]
test eax, eax
je 0xac6f00
lea edx, [eax + 0xf8]
cmp edx, dword [ebx + 4]
ja 0xac6ed1
mov ecx, dword [ebx]
push edi
push 0xf8
add ecx, eax
push ecx
lea edi, [esi + 0x40]
push edi
nop
call 0x766c8cf0
add esp, 0xc
cmp dword [edi], 0x4550
pop edi
jne 0xac6f00
mov edx, 0x10b
cmp word [esi + 0x58], dx
jne 0xac6f00
movzx eax, word [esi + 0x46]
test ax, ax
je 0xac6f00
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
add eax, eax
push eax
push 8
mov dword [esi + 0x140], eax
call dword [fcn.00cf90f4]
push eax
call dword [fcn.00cf9088]
mov dword [esi + 0x138], eax
test eax, eax
jne 0xac6ed7
mov eax, 3
ret
mov eax, 1
ret
movzx ecx, word [esi + 0x54]
mov edx, dword [esi + 0x3c]
lea ecx, [ecx + edx + 0x18]
mov edx, dword [esi + 0x140]
push ebx
push edx
push ecx
push eax
mov dword [esi + 0x13c], ecx
call fcn.00ac74d0
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret
mov eax, 2
ret
Function at 0xfbf010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor eax, eax
push esi
push edi
cmp byte [0xaed014], al
je 0xfbf02d
inc eax
cmp byte [eax + 0xaed014], 0
jne 0xfbf023
mov esi, dword [ebp + 8]
mov dword [esi + 8], eax
inc eax
call fcn.00f9da40
mov dword [esi], eax
test eax, eax
je 0xfbf04b
push 0xaed014
push eax
call dword [fcn.00cf9134]
mov esi, dword [0xcf8aa4]
xor eax, eax
cmp byte [esi], al
je 0xfbf05e
inc eax
cmp byte [esi + eax], 0
jne 0xfbf057
inc eax
call fcn.00f9da40
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0xfbf075
push esi
push ebx
call dword [fcn.00cf9134]
lea eax, [ebp - 0x24]
push eax
call dword [0xcf9044]
mov eax, dword [ebp - 0x16]
xor edi, edi
lea esi, [eax + eax*4]
mov word [0xcf8ec0], si
cmp dword [ebp + 0xc], edi
jle 0xfbf0e9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movzx ecx, si
mov dword [ebp - 4], eax
mov edi, edi
mov eax, ecx
shr eax, 2
xor eax, ecx
shr eax, 1
xor eax, ecx
shr eax, 2
xor eax, ecx
and eax, 1
mov dword [0xcf8ec4], eax
shl eax, 0xf
shr si, 1
or si, ax
movzx ecx, si
xor edx, edx
mov ebx, 0xb
mov eax, ecx
div ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
inc edi
mov dl, byte [edx + ebx]
mov byte [eax + edi - 1], dl
cmp edi, dword [ebp + 0xc]
jl 0xfbf0a0
mov word [0xcf8ec0], si
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebp + 0xc]
mov byte [eax + ecx], 0
test ebx, ebx
je 0xfbf161
mov ecx, dword [ebx - 8]
lea eax, [ebx - 0x10]
mov dword [eax], 1
test ecx, ecx
je 0xfbf131
cmp dword [ecx], 0
je 0xfbf131
cmp dword [0xcf91c4], ecx
jne 0xfbf11b
mov dword [0xcf91c4], eax
mov esi, dword [ecx + 4]
add dword [eax + 4], esi
mov esi, dword [ecx + 8]
mov dword [eax + 8], esi
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0xfbf131
mov dword [ecx + 0xc], eax
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xfbf161
cmp dword [ecx], 0
je 0xfbf161
cmp dword [0xcf91c4], eax
jne 0xfbf14b
mov dword [0xcf91c4], ecx
mov esi, dword [eax + 4]
add dword [ecx + 4], esi
mov esi, dword [eax + 8]
mov dword [ecx + 8], esi
mov eax, dword [eax + 8]
test eax, eax
je 0xfbf161
mov dword [eax + 0xc], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xfc1520
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0xcf90e0]
test esi, esi
jne 0xfc1538
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0xfc1531
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0xfc1531
mov eax, dword [eax + esi + 0x78]
mov ecx, dword [eax + esi + 0x1c]
add eax, esi
add ecx, esi
push ebx
mov ebx, dword [eax + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x18]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0xfc159a
jmp 0xfc1580
mov eax, dword [ebx + edi*4]
mov ecx, dword [0xcf8bf0]
add eax, esi
call fcn.00fbefb0
test eax, eax
je 0xfc15a3
inc edi
cmp edi, dword [ebp - 4]
jb 0xfc1580
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002c10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10049100]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x28]
push 0x28
mov byte [ebp - 0xc], al
call fcn.1001dc66
add esp, 4
test eax, eax
je 0x10002c4f
movups xmm0, xmmword [ebp + 8]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp + 0x18]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + 0x20], xmm0
jmp 0x10002c51
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push eax
push 0x10001540
push 0
push 0
call fcn.100265cf
add esp, 0x18
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10002c9a
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x10002c93
push ecx
push eax
call fcn.1001c65b
add esp, 8
test eax, eax
jne 0x10002c93
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001dfbd
mov esp, ebp
pop ebp
ret
push 1
call fcn.1001cd61
push 6
mov dword [ebp - 0x30], 0
call fcn.1001cd61
int3

Function at 0x10002ce0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10049100]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm1, xmmword [ebp + 8]
push esi
movups xmm0, xmmword [ebp + 0x18]
mov esi, dword [ebp + 0x28]
movd eax, xmm1
push edi
mov edi, dword [ebp + 0x2c]
push eax
movups xmmword [ebp - 0x404], xmm0
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3f4], eax
call fcn.100143e0
add esp, 4
test eax, eax
je 0x10002dc9
push 0x3e8
add eax, 0x10
push edi
push eax
call fcn.10022aa4
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002d42
sub eax, edx
xor edi, edi
sar eax, 1
mov esi, 0x1505
push ebx
lea ebx, [eax + eax]
test ebx, ebx
je 0x10002d89
mov eax, esi
mov ecx, edi
shld edi, esi, 5
shl esi, 5
add esi, eax
adc edi, ecx
mov ecx, dword [ebp - 0x3f0]
movzx eax, byte [ecx]
cdq
add esi, eax
adc edi, edx
inc ecx
mov dword [ebp - 0x3f0], ecx
sub ebx, 1
jne 0x10002d60
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10002ee0
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001dfbd
mov esp, ebp
pop ebp
ret
Function at 0x10005380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038b73
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x1000547a
test dl, 0x10
jne 0x1000547a
mov al, 1
jmp 0x1000547c
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x100054a0
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x100054d3
jbe 0x100054d3
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x100054b8
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.100046e0
jmp 0x100054d3
sub esi, edx
je 0x100054d0
shl esi, 3
push esi
push 0
push ebx
call fcn.1001fbf0
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1000d380
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
sar esi, 1
add esi, esi
je 0x1000d3b1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000d3a0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10010950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039505
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10010530
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100109e3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x38e38e3
je 0x10010b43
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1001dc66
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.100113a0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003c330]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1003c330]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10010ae5
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.100278a0
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001e460
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10010ac7
cmp ebx, 0x200
jae 0x10010ac5
shl ebx, 3
cmp ebx, ecx
jae 0x10010ac7
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10018790
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10010530
mov edx, dword [eax]
jmp 0x10010ae8
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10010b13
mov dword [ecx + eax*8], esi
jmp 0x10010b22
cmp edi, edx
jne 0x10010b1c
mov dword [ecx + eax*8], esi
jmp 0x10010b26
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10010b26
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.1001c5d5
int3