joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x3407b622
Capabilities:
Set registry value

Disassembly:
call fcn.34044726
test eax, eax
jl 0x3407b630
jmp fcn.3407ad34
ret

Function at 0x3407f0f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3403d054]
jne 0x3407fcb3
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34086a80], eax
mov dword [0x34086a7c], ecx
mov dword [0x34086a78], edx
mov dword [0x34086a74], ebx
mov dword [0x34086a70], esi
mov dword [0x34086a6c], edi
mov word [0x34086a98], ss
mov word [0x34086a8c], cs
mov word [0x34086a68], ds
mov word [0x34086a64], es
mov word [0x34086a60], fs
mov word [0x34086a5c], gs
pushfd
pop dword [0x34086a90]
mov eax, dword [ebp]
mov dword [0x34086a84], eax
mov eax, dword [ebp + 4]
mov dword [0x34086a88], eax
lea eax, [ebp + 8]
mov dword [0x34086a94], eax
mov eax, dword [ebp - 0x320]
mov dword [0x340869d0], 0x10001
mov eax, dword [0x34086a88]
mov dword [0x34086984], eax
mov dword [0x34086978], 0xc0000409
mov dword [0x3408697c], 1
mov eax, dword [0x3403d054]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34086850]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x340869c8], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3403d3b4
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x340869c8], 0
jne 0x3407fda3
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401c66
pop dword [ebp - 0x20]
mov eax, 0xbbcb2554
add eax, 0x4474f712
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc8d57871
sub dword [ebp - 0x30], 0x7a833326
mov dword [ebp - 0x2c], 0xe9c07ad5
add dword [ebp - 0x2c], 0x4872d170
mov dword [ebp - 0x28], 0xd78d355d
add dword [ebp - 0x28], 0x74bf0ed1
mov dword [ebp - 0x24], 0x19b07125
add dword [ebp - 0x24], 0xe64f8edb
lea eax, [ebp - 0x30]
push eax
mov eax, 0x6b1d7637
add eax, 0x9522ba1d
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x5580c886
add dword [ebp - 0x30], 0x1ef1a0d0
mov dword [ebp - 0x2c], 0x495d1520
sub dword [ebp - 0x2c], 0x7f0b3ab
mov dword [ebp - 0x28], 0x1ba9464a
sub dword [ebp - 0x28], 0xb839d9de
mov dword [ebp - 0x24], 0x1145d822
sub dword [ebp - 0x24], 0x1145d822
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xce586f42
sub eax, 0xce183f16
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37e4a
push 0
call eax
mov ecx, 0xd1ce35d
add ecx, 0xf2e36a49
xor edi, edi
add edi, eax
mov ebx, 0x63456e6c
sub ebx, 0x6304fe6c
add ebx, dword [ebp - 0x20]
mov esi, 0x4a150e3c
sub esi, 0x9cc2cc6a
xor dword [ebp - 0x18], 0x147df961
mov edx, dword [ebx]
xor dword [ebp - 4], 0xbd61fc7c
xor edx, esi
add dword [ebp - 0x1c], 0xe5fba7b2
mov dword [edi], edx
mov dword [ebp - 0x18], 0xaafbb518
add edi, 0x2074e054
sub edi, 0x2074e050
add ebx, 0x37e3c369
add ebx, 0xc81c3c9b
loop 0x401d8a
add eax, 0x61150918
add eax, 0x9eec2053
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd3aa8562
sub ecx, 0xd36a8562
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10013a33
pop dword [ebp - 0x10]
mov eax, 0x10013a33
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb34c03f8
sub dword [ebp - 0x20], 0x64f9bead
mov dword [ebp - 0x1c], 0xd3d862ed
add dword [ebp - 0x1c], 0x5e5ae958
mov dword [ebp - 0x18], 0x479c3a9b
sub dword [ebp - 0x18], 0xfb4ff66d
mov dword [ebp - 0x14], 0x2ec0eb3c
add dword [ebp - 0x14], 0xd13f14c4
lea eax, [ebp - 0x20]
push eax
mov eax, 0x48eac874
sub eax, 0x38e907f4
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x8af2b17f
add dword [ebp - 0x20], 0xe97fb7d7
mov dword [ebp - 0x1c], 0x6d4b74e1
add dword [ebp - 0x1c], 0xd420ec94
mov dword [ebp - 0x18], 0x2353bdf7
add dword [ebp - 0x18], 0x401bae75
mov dword [ebp - 0x14], 0x7f8e0d55
sub dword [ebp - 0x14], 0x7f8e0d55
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x9bcc469c
add eax, 0x74357964
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x37335
push 0
call eax
mov ecx, 0x2ce26347
add ecx, 0xd31de3e1
mov ebx, eax
mov edi, 0xde885c28
add edi, 0x317a0bd8
add edi, dword [ebp - 0x10]
mov edx, 0xb6256b48
add edx, 0x2cfa683e
mov dword [ebp - 8], 0xf7d2a512
mov esi, dword [edi]
sub dword [ebp - 0xc], 0x7b22c83e
sub esi, edx
sub dword [ebp - 4], esi
mov dword [ebx], esi
xor dword [ebp - 4], ebx
add ebx, 0x573911b5
sub ebx, 0x573911b1
add edi, 4
loop 0x10013b50
add eax, 0x10f73
xor ebx, ebx
add ebx, eax
add eax, 0x557e8b94
sub eax, 0x557e8b8f
mov ecx, 0x35a6f060
add ecx, 0xda590fa0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10003c3d
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x10003e14
cmp dword [0x100ea390], 0
jne 0x10003e0d
push ebx
push ebp
push edi
call fcn.10004526
mov ebx, eax
test ebx, ebx
jne 0x10003c80
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x10003dee
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x100ea390
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x10003e0d
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100ea390]
jmp 0x10003e16
xor eax, eax
add esp, 0x74
ret
Function at 0x10004b60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9ac5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100e5f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10004a40
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10004bf3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xccccccc
je 0x10004d4f
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100a9c6f
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c7fb0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c7fb0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10004cf1
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100a9cc0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10004cd3
cmp ebx, 0x200
jae 0x10004cd1
shl ebx, 3
cmp ebx, ecx
jae 0x10004cd3
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100074b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10004a40
mov edx, dword [eax]
jmp 0x10004cf4
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10004d1f
mov dword [ecx + eax*8], esi
jmp 0x10004d2e
cmp edi, edx
jne 0x10004d28
mov dword [ecx + eax*8], esi
jmp 0x10004d32
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10004d32
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1009257b
int3
Function at 0x10005840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100e5f80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x200], 0xf
push 0
movups xmmword [ebp - 0x214], xmm0
push eax
mov byte [ebp - 0x214], 0
mov dword [ebp - 0x1fc], 0
call sub.msvcrt.dll_memset
push 0x1f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100ab4b0
mov ecx, dword [ebp - 0x200]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x100058eb
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100058e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005943
push ecx
push edx
call fcn.100a9c9f
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100084f0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100ae500
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x100ea430
push 0x1f8
push eax
push dword [0x100e5338]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a9cad
mov esp, ebp
pop ebp
ret
call fcn.100ab190
int3

Function at 0x100059c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e5f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x100ea3b0]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10005a2c
xorps xmm0, xmm0
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
pop edi
mov dword [ebx + 0x14], 0xf
pop esi
mov byte [ebx], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a9cad
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x100059f4
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 0x20]
push esi
call fcn.10004910
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, ebx
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [ebx], xmm0
pop esi
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.100a9cad
mov esp, ebp
pop ebp
ret
Function at 0x10005e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9c25
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100e5f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x44], esi
mov eax, dword [esi + 0x5f8]
test eax, eax
je 0x10005e4d
push dword [esi]
push eax
push str._p____p
call fcn.10005840
add esp, 0xc
mov eax, dword [0x100ea424]
inc eax
mov dword [0x100ea424], eax
cmp eax, 0x9c4
jl 0x10005e73
push str.too_many_hooks:_cant_insert
call fcn.10005840
add esp, 4
xor al, al
jmp 0x10005fc0
test edi, edi
je 0x10005e90
cmp byte [edi], 0
je 0x10005e90
push 0x3b
push edi
lea eax, [esi + 0x1d0]
push 0x3c
push eax
call fcn.100ab4b0
add esp, 0x10
lea eax, [esi + 0x1d0]
push eax
push str.inserting_hook:__s
call fcn.10005840
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0x608
lea eax, [ebp - 0x28]
mov edi, esp
mov ecx, 0x182
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10075a80
add esp, 0x610
cmp dword [eax + 0x14], 7
jbe 0x10005ed1
mov eax, dword [eax]
mov esi, dword [ebp - 0x44]
push eax
push 0x1f4
lea ecx, [esi + 0x20c]
push ecx
mov dword [ebp - 0x48], ecx
call fcn.100ab320
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10005550
imul eax, dword [0x100ea424], 0x6c8
sub esp, 0x608
mov edi, esp
mov ecx, 0x182
rep movsd dword es:[edi], dword [esi]
add eax, dword [0x100ea420]
mov ecx, eax
call fcn.10008a90
test al, al
jne 0x10005f8f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x28]
call fcn.10004f00
push 0xfde9
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10074130
add esp, 0xc
cmp dword [eax + 0x14], 0xf
mov byte [ebp - 4], 1
jbe 0x10005f51
mov eax, dword [eax]
push eax
push str.failed_to_insert_hook__s
call fcn.10005840
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10005500
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10005550
imul ecx, dword [0x100ea424], 0x6c8
add ecx, dword [0x100ea420]
call fcn.10008840
xor al, al
jmp 0x10005fc0
mov eax, dword [ebp - 0x44]
push 0
push 0x100ea430
push 0x10
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
push eax
push dword [0x100e5338]
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a9cad
mov esp, ebp
pop ebp
ret
Function at 0x10005fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x100e5f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x610]
push esi
push edi
mov dword [ebp - 0xa18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0x608
lea eax, [ebp - 0x1c]
mov edi, esp
lea esi, [ebp + 8]
mov ecx, 0x182
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10075a80
add esp, 0x610
cmp dword [eax + 0x14], 7
jbe 0x10006031
mov eax, dword [eax]
push eax
lea eax, [ebp + 0x214]
push 0x1f4
push eax
call fcn.100ab320
mov ecx, dword [ebp - 8]
add esp, 0xc
cmp ecx, 7
jbe 0x10006080
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10006076
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100060fb
push ecx
push edx
call fcn.100a9c9f
add esp, 8
push 0x3e8
lea eax, [ebp - 0x404]
mov dword [ebp - 0xa14], 2
mov ecx, 0x182
lea esi, [ebp + 8]
lea edi, [ebp - 0xa0c]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call sub.msvcrt.dll_memset
push 0x1f3
push dword [ebp - 0xa18]
lea eax, [ebp - 0x404]
push 0x1f4
push eax
call fcn.100ab3c0
add esp, 0x1c
lea eax, [ebp - 0xa14]
push 0
push 0x100ea430
push 0x9f8
push eax
push dword [0x100e5338]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100a9cad
mov esp, ebp
pop ebp
ret
call fcn.100ab190
int3

Function at 0x10006110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
test eax, eax
je 0x1000612b
push eax
push str.removing_hook:__s
call fcn.10005840
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0
push 0x100ea430
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [0x100e5338]
mov dword [ebp - 0x10], 3
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x10007090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x28]
movups xmm0, xmmword [ebp + 8]
mov eax, dword [ebp + 0x2c]
push 0
movups xmmword [ecx], xmm0
push 0x100ea430
movups xmm0, xmmword [ebp + 0x18]
add eax, 0x28
push eax
push ecx
movups xmmword [ecx + 0x10], xmm0
push dword [0x100e5338]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
ret

Function at 0x100074b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10007609
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100070d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100075dc
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10007561
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100075d2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1000759b
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10007593
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x100075cf
cmp edi, edx
je 0x100075ac
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100075e5
cmp edi, edx
jne 0x100075a0
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10007512
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100075cf
push str.invalid_hash_bucket_count
call fcn.1009257b
int3