joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4341a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4548d4], 0
je 0x4341b6
xor eax, eax
jmp 0x4343d2
cmp dword [0x4548d0], 0
je 0x4341c9
mov eax, dword [0x4548d0]
jmp 0x4343d2
push 0x24
push 0
push 0x4548ac
call fcn.00428f40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x4548ac], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x4548b0], eax
cmp dword [0x4548b0], 0
jne 0x43426e
mov dword [0x4548d4], 1
cmp dword [0x4548b0], 0
je 0x434221
mov eax, dword [0x4548b0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4548b4], 0
mov dword [0x4548b8], 0
mov dword [0x4548bc], 0
mov dword [0x4548c0], 0
mov dword [0x4548c4], 0
mov dword [0x4548c8], 0
mov dword [0x4548cc], 0
xor eax, eax
jmp 0x4343d2
push str.ImagehlpApiVersionEx
mov ecx, dword [0x4548b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548b4], eax
push str.SymInitialize
mov edx, dword [0x4548b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548b8], eax
push str.SymSetOptions
mov eax, dword [0x4548b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548bc], eax
push str.SymGetOptions
mov ecx, dword [0x4548b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548c0], eax
push str.SymLoadModule64
mov edx, dword [0x4548b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548c4], eax
push str.SymGetModuleInfo64
mov eax, dword [0x4548b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548c8], eax
push str.SymFromName
mov ecx, dword [0x4548b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4548cc], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.00428f40
add esp, 0xc
mov eax, 0xb
mov word [ebp - 8], ax
cmp dword [0x4548b4], 0
je 0x434353
cmp dword [0x4548b8], 0
je 0x434353
cmp dword [0x4548c4], 0
je 0x434353
cmp dword [0x4548c8], 0
je 0x434353
cmp dword [0x4548cc], 0
jne 0x434358
jmp 0x434202
lea ecx, [ebp - 8]
push ecx
call dword [0x4548b4]
movzx edx, word [ebp - 8]
cmp edx, 0xb
jge 0x434370
jmp 0x434202
push 0
push 0
mov eax, dword [0x4548ac]
push eax
call dword [0x4548b8]
test eax, eax
jne 0x434389
jmp 0x434202
cmp dword [0x4548c0], 0
je 0x4343c3
cmp dword [0x4548bc], 0
je 0x4343c3
call dword [0x4548c0]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x2704
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4548bc]
mov dword [0x4548d0], 0x4548ac
mov eax, dword [0x4548d0]
mov esp, ebp
pop ebp
ret
Function at 0x40223c
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov ebx, ecx
mov esi, edx
mov edi, eax
push esi
push edi
call sub.user32.DLL_SetCursorPos
push esi
push edi
push 0x4022b0
lea eax, [esp + 0xc]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
push esp
call sub.kernel32.dll_OutputDebugStringA
test bl, bl
je 0x402289
push 0
push 0
push esi
push edi
push 2
call sub.user32.DLL_mouse_event
push 0
push 0
push esi
push edi
push 4
call sub.user32.DLL_mouse_event
jmp 0x4022a7
push 0
push 0
push 0
push 0
push 8
call sub.user32.DLL_mouse_event
push 0
push 0
push 0
push 0
push 0x10
call sub.user32.DLL_mouse_event
add esp, 0x2c
pop edi
pop esi
pop ebx
ret

Function at 0x402350
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, 0x208
call fcn.00401448
mov dword [esp], eax
mov eax, dword [esp]
push eax
push 0
push 0
push 0x1c
push 0
call sub.shfolder.dll_SHGetFolderPathW
push 0x4023b4
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrlenW
dec eax
add eax, eax
cdq
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x4023ad
push 0x4023b4
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrcatW
mov eax, dword [esp]
pop edx
ret

Function at 0x4023b8
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, 0x208
call fcn.00401448
mov dword [esp], eax
cmp dword [esp], 0
je 0x402419
push 0x208
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
push 0x402420
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrlenW
dec eax
add eax, eax
cdq
push edx
push eax
mov eax, dword [esp + 0xc]
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x402419
push 0x402424
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrcatW
mov eax, dword [esp]
pop edx
ret

Function at 0x402454
Capabilities:
Persist via run registry key

Disassembly:
push ebx
add esp, 0xfffffdf0
push 0x208
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrlenW
mov ebx, eax
add ebx, 3
mov eax, esp
mov edx, ebx
call fcn.004014d0
cmp dword [esp], 0
je 0x4024f3
mov edx, ebx
mov eax, dword [esp]
call fcn.00401538
lea eax, [esp + 4]
push eax
push 0x4024fc
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_wsprintfW
add esp, 0xc
mov eax, dword [esp]
push eax
push 0
mov ecx, dword [0x40809c]
mov ecx, dword [ecx]
mov edx, dword [0x408044]
mov eax, 0x80000002
call fcn.004016a8
test al, al
jne 0x4024eb
mov eax, dword [esp]
push eax
push 0
mov ecx, dword [0x40809c]
mov ecx, dword [ecx]
mov edx, dword [0x408044]
mov eax, 0x80000001
call fcn.004016a8
mov eax, dword [esp]
call fcn.00401438
add esp, 0x210
pop ebx
ret
Function at 0x40686c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x409368], eax
xor eax, eax
mov dword [0x40936c], eax
push 1
xor ecx, ecx
mov dl, 0x29
mov eax, dword [ebp - 4]
call fcn.004031c0
mov eax, 0x409364
mov edx, 0x1000
call fcn.004014b4
cmp dword [0x409364], 0
je 0x4068e0
push 0
push 0x406774
call sub.user32.DLL_EnumWindows
cmp dword [0x40936c], 0
je 0x4068d6
mov eax, dword [0x40936c]
add eax, eax
inc eax
push eax
mov ecx, dword [0x409364]
mov dl, 0x2a
mov eax, dword [ebp - 4]
call fcn.004031c0
mov eax, dword [0x409364]
call fcn.00401438
push 1
xor ecx, ecx
mov dl, 0x2b
mov eax, dword [ebp - 4]
call fcn.004031c0
pop ecx
pop ebp
ret

Function at 0x406ff8
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [0x40807c]
mov esi, dword [0x4080c4]
mov edi, dword [0x4080e8]
mov ebp, dword [0x4080dc]
mov eax, dword [0x4080ec]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov byte [ebp], 0
mov eax, dword [ebx]
mov eax, dword [edi + eax*4]
mov edx, dword [0x4080a4]
mov edx, dword [edx]
call fcn.00403140
mov dword [esi], eax
cmp dword [esi], 0xffffffff
je 0x40704c
mov byte [ebp], 1
mov eax, dword [esi]
call fcn.00406f58
mov byte [ebp], 0
inc dword [ebx]
mov eax, dword [ebx]
cmp dword [edi + eax*4], 0
jne 0x40705e
xor eax, eax
mov dword [ebx], eax
mov eax, dword [esi]
call fcn.00403064
push 0x4e20
call sub.kernel32.dll_Sleep
jmp 0x407028
Function at 0x401ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ecx
in al, dx
adc al, 0x53
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x69], eax
call fcn.0040b100
mov dword [0xb2410ba0], eax
push 0x180ba4d2
add byte [ebx + 0x142419d8], cl
test dword [esi], esp
mov edi, edx
jne 0x401f01
mov esp, dword [ebx]
add al, 0x6a
add byte [edi], ah
add byte [ecx - 0x18], dl
xchg esi, eax
insd dword es:[edi], dx
xchg esi, eax
pop esi
mov dword [esi + 0xb738], ebx
mov esi, edx
push ds
or byte [eax], al
fld st(7)
inc esi
sbb byte [ecx], al
add byte [eax], al
add byte [ebx + 0x4117ec15], cl
add byte [ecx + 0x60a11456], cl
add al, byte [ecx]
test eax, eax
je 0x401f3a
mov eax, dword [0x410270]
add al, byte [ecx]
mov ecx, edx
xchg ebp, eax
jl 0x401f31
dec esi
adc al, 0xeb
sub eax, 0x8598e8b
add byte [eax], al
mov eax, dword [0x40d026]
mov ecx, dword [ebx]
lodsb al, byte [esi]
adc al, byte [eax]
add eax, dword [ebx]
mov eax, dword [esi + 0x1a083c]
adc eax, edx
cmp edi, eax
jg 0x408c15
jl 0x401f3a
or byte [ebx], bh
invalid
cmp ebx, ecx
ja 0xd340200a
add byte [eax], al
ror dword [ecx + 0x1d8b1856], cl
xor al, dl
inc eax
add byte [ecx], bl
inc esi
add al, 0x8d
sahf
aam 3
sar dword [ebx], cl
mov dword [esi + 0x18], edx
mov ebx, dword [0x40d030]
sbb dword [esi + 4], eax
lea ebx, [esi + 0x3bd303d4]
stosd dword es:[edi], eax
jecxz 0x401f37
insd dword es:[edi], dx
retf
pop ebp
ret

Function at 0x408a80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ecx, dword [esi]
mov eax, dword [ebp + 8]
inc ebp
inc eax
outsd dx, dword [esi]
adc al, 0xc1
inc eax
add byte [ebx - 0x3f05fb3c], al
je 0x408aa7
mov ecx, dword [ebp + 0x10]
mov esi, dword [edx + 0xc]
push eax
jmp 0x408aef
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x12]
push 0x40cd54
push eax
push ecx
call 0x3fb080
add esp, 0xc
pop ebp
ret
add byte [eax], al
add byte [eax], al
popfd
adc eax, sym.imp.WS2_32.dll_WSASend
cmp eax, 0xffffffff
jne 0x408b2a
push edi
mov ecx, dword [ebp - 0x28]
mov dword [0xd7000040], eax
test eax, eax
mov al, 0xa
mov dword [esi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x8f0c
mov esp, dword [ebp - 4]
mov dword [esi], eax
xor eax, eax
pop esi
inc ebp
push 0xc545d
nop
nop
nop
nop
sub byte [eax - 0x74aaad70], dl
in al, dx
je 0x408b31
adc byte [ebx - 0x74a9f3b3], cl
jne 0x408b89
push 0
lea edx, [ebp - 8]
push 0
mov eax, dword [esi]
xchg byte [ebx + 0x9890855], cl
invalid
push ecx
fadd st(1)
inc eax
add bh, bh
xlatb
test eax, eax
jne 0x408b9e
mov dword [esi], eax
sub byte [ebx - 0x28], al
dec ax
test eax, 0xd7ff00b2
call edi
mov dword [esi], 0x5493
pop edi
add eax, 0xafc80
pop esi
mov esp, ebp
pop ebp
ret 0x20c
Function at 0x401050
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3ac
mov eax, dword [0x403004]
xor eax, esp
mov dword [esp + 0x3a8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x20]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4010a9
push eax
push str.WSAStartup_failed:__d_n
call fcn.00401010
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a8]
xor ecx, esp
call fcn.00401228
mov esp, ebp
pop ebp
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4010f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Error_at_socket__:__ld_n
call fcn.00401010
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3a8]
xor ecx, esp
call fcn.00401228
mov esp, ebp
pop ebp
ret
mov eax, 2
push str.127.0.0.1
mov word [esp + 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1e61
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401141
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Unable_to_connect_to_server:__ld_n
jmp 0x4010c8
push 0
push 0xa
push str.S3cur3P4ss
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x401176
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.send_failed:__d_n
call fcn.00401010
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4010d0
push eax
push str.Bytes_Sent:__ld_n
call fcn.00401010
add esp, 8
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x4011b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.shutdown_failed:__d_n
call fcn.00401010
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4010d0
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, dword [sym.imp.WS2_32.dll_recv]
nop
push 0
push 0x200
lea eax, [esp + 0x1b8]
push eax
push esi
call ebx
test eax, eax
jle 0x4011f0
lea eax, [esp + 0x1b0]
push eax
push 0x4021dc
call fcn.00401010
add esp, 8
push esi
call edi
jmp 0x4011c0
jne 0x4011ff
push str.Connection_closed_n
call fcn.00401010
add esp, 4
push esi
call edi
cmp eax, 0xffffffff
je 0x4010d0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x3b4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401228
mov esp, ebp
pop ebp
ret
Function at 0x442b70
Capabilities:
Execute syscall

Disassembly:
inc ecx
xor al, 0xe8
pop ss
jecxz 0x442b08
mov al, 0x14
inc ebp
lcall 0xa5f9, 0xf139b160
mov esi, 0x8daf1bbc
mov ebx, 0xfdbf7b21
pop edx
push ebx
cmp byte [ebp - 0x6e], cl
or edx, dword [ebx + ebx*2 - 0x66c90689]
push es
fiadd word fs:[ebp - 0x23732d92]
add bh, byte [0x559936e0]
cmp eax, 0x559936e0

Function at 0x443120
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp eax, esp
cmc
jg 0x44317a
jb 0x443198
aas
push es
fnstsw word [ecx + 0x1bd2a2b6]
add byte [edi + 0x40bdaf46], dl
test eax, 0x249e04b4
iretd
xchg ebx, eax
and edi, ebp
jns 0x4431bf
push es
adc dl, byte [ebp + 0x39fc2427]
invalid
inc esp
fbld tbyte [edi]
out dx, eax
cmpsb byte [esi], byte es:[edi]
jp 0x4431d8
sbb esi, dword [edi - 0x49b536d5]
pop ds
test byte [ebx - 0x75], al
test dword [eax + 0x29], edx
fucom st(6)
wait
or edi, ebx
xor byte [edx + 0xd], al
dec edi
ljmp 0x736a
mov bh, 0xb8
out dx, eax
xor ch, byte [edx + 0x73]
and byte [eax + edi*8 - 0x20], bh
push edi
jmp 0x443155
iretd
add dl, byte [ebx - 0x62]
pop ss
dec ebp
ja 0x4431ff
out dx, al
cmp al, 0xe0
push es
sti
xor esp, dword [ebx + 0x271541eb]
stc
ret 0xb57e
pop es

Function at 0x443200
Capabilities:
Check for vm using instruction vpcext

Disassembly:
imul esp, dword [ecx + 0x485109cb], 0x5180babf
push es
pop esi
add ch, byte [eax + edx*8 - 0x48c38af3]
dec ebx
mov esi, 0xe98891cf
and ch, ch
dec ecx
ja 0x443251
stc
cmp dword [ecx - 0x5a36e72e], esi
std
pushfd
mov edx, 0xcf7b7cb9
push ecx
cld
loope 0x443240
xor al, 0x40
mov edx, 0x5888a945
stosb byte es:[edi], al
in al, 0xcc
mov esp, 0xb6dbfa05
jle 0x4432be
ficomp word cs:[ebx + 0x3b]
mov ebx, 0x34290ba
lodsb al, byte [esi]
mov ebp, 0xb10f5674
fadd qword [edx + 0x289e6616]
insd dword es:[edi], dx
aaa
sahf
pushal
dec ecx
fbld tbyte [eax]
cld
sub byte [eax - 0x45], ah
mov cl, 0xd1
jp 0x44331a
pushfd
popal
dec ecx
aam 0x58
invalid
Function at 0x10001dd7
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x10001fae
cmp dword [0x10035268], 0
jne 0x10001fa7
push ebx
push ebp
push edi
call fcn.1000261c
mov ebx, eax
test ebx, ebx
jne 0x10001e1a
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x10001f88
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x10035268
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x10001fa7
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10035268]
jmp 0x10001fb0
xor eax, eax
add esp, 0x74
ret
Function at 0x10003330
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x3f4], eax
call fcn.10014730
add esp, 4
test eax, eax
je 0x1000340c
push esi
add eax, 0x158
push 0x3e8
push eax
call fcn.1001eb00
mov eax, ebx
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003380
sub eax, edx
mov esi, 0x1505
push edi
sar eax, 1
xor edi, edi
add eax, eax
je 0x100033cc
nop dword [eax + eax]
dec eax
lea ebx, [ebx + 1]
mov dword [ebp - 0x3f0], eax
mov ecx, edi
mov eax, esi
shld edi, esi, 5
shl esi, 5
add esi, eax
movzx eax, byte [ebx - 1]
cdq
adc edi, ecx
add esi, eax
mov eax, dword [ebp - 0x3f0]
adc edi, edx
test eax, eax
jne 0x100033a0
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10003a30
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d60d
mov esp, ebp
pop ebp
ret
Function at 0x10006420
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026b63
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10034100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x1000651a
test dl, 0x10
jne 0x1000651a
mov al, 1
jmp 0x1000651c
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x10006540
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x10006573
jbe 0x10006573
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x10006558
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.10005610
jmp 0x10006573
sub esi, edx
je 0x10006570
shl esi, 3
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1000e0e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1000e111
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1000e100
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10010a80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027505
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10034100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10010500
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10010b13
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x3333333
je 0x10010c73
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1001d5cf
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.10011380
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002d230]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1002d230]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10010c15
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001da90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10010bf7
cmp ebx, 0x200
jae 0x10010bf5
shl ebx, 3
cmp ebx, ecx
jae 0x10010bf7
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10017e50
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10010500
mov edx, dword [eax]
jmp 0x10010c18
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10010c43
mov dword [ecx + eax*8], esi
jmp 0x10010c52
cmp edi, edx
jne 0x10010c4c
mov dword [ecx + eax*8], esi
jmp 0x10010c56
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10010c56
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.1001bba5
int3