joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e5e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push esi
push eax
push 0x20019
push 0
push 0x4014e0
push 0x80000002
mov esi, 0x19000
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x405ec9
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x401a50
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x405ebf
cmp dword [ebp - 0xc], edi
jne 0x405ebf
cmp dword [ebp - 4], edi
jne 0x405ebf
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
call fcn.00401451
call dword [0x40652a]
adc eax, 0x40652a
mov dword [0x403071], eax
mov ebx, 0x7f00
push ebx
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov ebx, 0x403059
mov dword [0x403069], 0x400000
mov dword [0x40306d], 0
push ebx
call dword [sym.imp.user32.dll_RegisterClassA]
call fcn.0040100f
push edi
sbb byte [eax], al
xor bh, byte [ecx - 0x19]
xchg esi, eax
push es
add byte [ebp + ebp + 0x7d9e3], cl
mov eax, 0xd29a9e8
add bh, dl
and cl, byte [eax]
daa
adc dword [eax], eax
in al, dx
dec edx
or eax, 0x9f00120d
jno 0x40201e
or dword [edi], ecx
add byte [edx + 0x50], ch
stosd dword es:[edi], eax
push cs
verw word [esi + 0x1040c48c]
add byte [ebx], ah
hlt
Function at 0x4010b3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x40b328
cmp dword [edi], ebx
je 0x401158
push str._mozilla.org_observer_service_1
mov edx, 0x40b6f0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.00408f48
mov eax, dword [ebp - 4]
test eax, eax
je 0x401138
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_qm
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change_telemetry
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.00408ff7
mov eax, dword [ebp - 4]
test eax, eax
je 0x401158
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x40118f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x40118f
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.004015f1
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.0040186f
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4011ab
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x4011b8
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x4011c4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x4011d4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x705823b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x7058240b
cmp byte [esi + ebx - 1], 0xa
je 0x705823df
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x70583118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5a3246be
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x23e76bad
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp fcn.00431219
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630
Function at 0x8ddef0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ddef6
pop ebp
sub ebp, 6
sub ebp, 0x4ddef0
jmp 0x8ddf54
jmp 0x8ddf5d
mov eax, 0x4ddef0
add eax, ebp
add eax, 0x93
mov ecx, 0x634
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x634], bh
mov edx, 0x4db8af98
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ddf74
jmp 0x8ddf87
fdiv st(0)
cwde
mov byte [eax + 0x5498f098], bl
mov ah, 0x98
sbb dword [eax + 0x1d], ebp
pop edi
mov dword [esi + 0x19], edi
push 0x7e895f1d
stosd dword es:[edi], eax
pop eax
enter 0xd67, 0xffffffffffffffa4
mov ecx, 0x13c898dc
push ebp
adc edx, dword [ecx]
movsb byte es:[edi], byte [esi]
cwde
cwde
cwde
sbb dword [ecx + 0x60], ebx
cwde
cwde
cwde
wait
push ebp
and byte [esi + 0x22989898], bl
mov al, 0x98
cwde
cwde
outsd dx, dword [esi]
jp 0x8ddf61
push eax
adc ebx, dword [ecx]
xchg esp, eax
cwde
cwde
cwde
wait
pop ebp
enter 0x73f0, 0xffffffffffffffac
xchg ecx, eax
cwde
invalid
Function at 0x4067a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4286f3
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x439018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [0x42a094]
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00406700
mov edi, eax
mov dword [ebp - 4], 0
call dword [0x42a094]
mov edx, eax
lea ecx, [ebp - 0x88]
call fcn.00405e70
push eax
mov edx, 0x435aa8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0040c2c0
push 0x435a98
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58]
call fcn.0040c330
push edi
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x40]
call fcn.0040c4f0
push 0x435a8c
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0040c330
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.00402fe0
lea ecx, [ebp - 0x58]
call fcn.00402fe0
lea ecx, [ebp - 0x70]
call fcn.00402fe0
lea ecx, [ebp - 0x88]
call fcn.00402fe0
lea ecx, [ebp - 0xa0]
call fcn.00402fe0
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.00402fd0
push eax
push 0x435abc
push 0
push 0
call dword [0x42a1c4]
push 0
call fcn.00417030
int3
Function at 0x40ad50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2b], 0
je 0x40ad8a
movaps xmm1, xmmword [0x435d30]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x40ad60
cmp eax, 0x2c
jae 0x40ad8a
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x2c
jb 0x40ad80
mov eax, ecx
ret
Function at 0x4018b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi], 1
jne 0x4019d6
mov eax, dword [edi + 0x498]
cmp eax, 0x64
jge 0x4019d6
mov ecx, dword [ebp + 8]
inc eax
mov dword [edi + 0x498], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x40], eax
movzx eax, cx
push 0x40
mov dword [edi + 0x3c], eax
lea eax, [ebp - 0x25c]
shr ecx, 0x10
push 0
push eax
mov dword [edi + 0x44], ecx
call fcn.0040a280
xor eax, eax
mov dword [ebp - 0x260], 0x44
push 0x208
push eax
mov word [ebp - 0x218], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x216]
push eax
movdqu xmmword [ebp - 0x270], xmm0
call fcn.0040a280
lea ecx, [edi + 0x1c]
add esp, 0x18
cmp dword [ecx + 0x14], 8
jb 0x401948
mov ecx, dword [ecx]
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x401953
mov eax, dword [eax]
push ecx
push eax
push str._s__start___s_
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004053c0
add esp, 0x18
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4019d6
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0xea60
push 0x7cd
push dword [edi + 0x490]
mov dword [edi], 0
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 8
Function at 0x4019f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412d14
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi], 0
jne 0x401c00
push 0x7cd
push dword [edi + 0x490]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x40
lea eax, [ebp - 0x294]
push 0
push eax
call fcn.0040a280
add esp, 0xc
mov dword [ebp - 0x298], 0x44
xorps xmm0, xmm0
lea ecx, [ebp - 0x250]
movdqu xmmword [ebp - 0x2a8], xmm0
call fcn.004013c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
push dword [edi + 0x44]
mov edx, dword [edi + 0x3c]
push dword [edi + 0x40]
call fcn.004012a0
xor eax, eax
mov byte [ebp - 4], 1
push 0x208
push eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push eax
call fcn.0040a280
add esp, 0x14
lea ecx, [ebp - 0x238]
cmp dword [ebp - 0x224], 8
lea edx, [ebp - 0x250]
lea eax, [edi + 4]
cmovae ecx, dword [ebp - 0x238]
cmp dword [ebp - 0x23c], 8
cmovae edx, dword [ebp - 0x250]
cmp dword [eax + 0x14], 8
jb 0x401adc
mov eax, dword [eax]
push ecx
push edx
push eax
push str._s__stop___s_s.etl_
push 0xffffffffffffffff
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.004053c0
add esp, 0x1c
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x298]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401bb5
push 0xffffffffffffffff
push dword [ebp - 0x2a8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x2a4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2a8]
call esi
cmp dword [edi + 0x34], 0
jne 0x401baf
push 0x58
call fcn.0040536f
mov esi, eax
add esp, 4
mov dword [ebp - 0x2ac], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x401b9c
push 0x58
push 0
push esi
call fcn.0040a280
add esp, 0xc
lea eax, [ebp - 0x238]
mov ecx, esi
push dword [edi + 0x490]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.00403120
jmp 0x401b9e
xor eax, eax
mov ecx, eax
mov dword [edi + 0x34], eax
call fcn.004048e0
mov dword [edi + 0x38], 0
mov dword [edi], 1
cmp dword [ebp - 0x224], 8
jb 0x401bcc
push dword [ebp - 0x238]
call fcn.00404cd5
add esp, 4
xor eax, eax
mov dword [ebp - 0x224], 7
cmp dword [ebp - 0x23c], 8
mov dword [ebp - 0x228], 0
mov word [ebp - 0x238], ax
jb 0x401c00
push dword [ebp - 0x250]
call fcn.00404cd5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404cc6
mov esp, ebp
pop ebp
ret
Function at 0x403000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4b0
mov eax, dword [0x41d008]
xor eax, esp
mov dword [esp + 0x4ac], eax
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, eax
cmp dword [esp + 0xc], 2
jne 0x40305b
push dword [edi + 4]
push 0x419a48
call fcn.00405467
add esp, 8
mov ecx, 1
test eax, eax
cmove esi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x4a0
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0040a280
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.004017d0
push esi
lea ecx, [esp + 0x14]
call fcn.00401f00
test eax, eax
je 0x403092
call fcn.004020b0
lea ecx, [esp + 0x10]
call fcn.00402020
lea ecx, [esp + 0x58]
call fcn.00403860
cmp dword [esp + 0x40], 8
jb 0x4030b7
push dword [esp + 0x2c]
call fcn.00404cd5
add esp, 4
xor eax, eax
mov dword [esp + 0x40], 7
cmp dword [esp + 0x28], 8
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
jb 0x4030e1
push dword [esp + 0x14]
call fcn.00404cd5
add esp, 4
mov ecx, dword [esp + 0x4b4]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4040d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov edx, dword [ebp + 8]
push edi
mov dword [ebp - 8], edx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
mov dword [ebp - 0xc], esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, eax
cmp dword [ebx + 0x18], edi
ja 0x404138
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov eax, dword [ebx + 8]
lea esi, [edi*8]
mov ecx, dword [ebx]
mov dword [ebp - 0x14], esi
lea esi, [eax + edi*8]
mov eax, dword [esi]
cmp eax, ecx
jne 0x404154
mov esi, ecx
jmp 0x404159
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x404183
mov eax, dword [ebp - 0xc]
shl edi, 3
mov dword [ebp - 0x10], edi
mov edi, dword [ebx + 8]
mov eax, dword [eax]
jmp 0x404170
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x4041a7
mov edx, dword [ebp - 0x10]
cmp esi, dword [edi + edx]
mov edx, dword [ebp - 8]
jne 0x404170
mov edi, dword [ecx]
push dword [ebp - 0xc]
push dword [edi + 4]
push edi
call fcn.00404530
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 4]
sub ecx, eax
cmp ecx, 1
jae 0x4041c2
jmp 0x404255
mov dword [edx], esi
mov eax, edx
mov byte [edx + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 0xc
inc eax
mov dword [ebx + 4], eax
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x4041f9
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x404212
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x404232
cmp eax, esi
jne 0x40421a
mov dword [ecx], edi
jmp 0x404232
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x404232
add edx, dword [ebx + 8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
call fcn.004042a0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.00404c64
int3
Function at 0x404390
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 8], eax
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov edx, dword [ebx + 0x14]
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x4043f5
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 0x10], eax
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x40442d
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x40442d
mov eax, dword [edi]
lea ecx, [ecx]
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x404470
cmp esi, dword [edx + ecx*8]
jne 0x404420
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x404457
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 0x10]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4044aa
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x4044ca
mov edi, dword [ebp + 0x10]
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 4]
call fcn.00404cd5
mov eax, dword [ebp - 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4044b2
mov dword [ecx], edi
jmp 0x4044ca
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4044ca
add edx, dword [ebx + 8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
call fcn.004042a0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
call fcn.00404cc6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404680
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x41d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [edx], ax
jne 0x4046c9
xor ecx, ecx
jmp 0x4046df
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4046d0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00402820
push ecx
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], 0x5c
call fcn.004047f0
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
cmp esi, 0xffffffff
je 0x404764
mov dword [ebp - 0x44], 0x5c
lea ebx, [ebx]
push esi
push ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004047b0
cmp dword [eax + 0x14], 8
jb 0x404736
mov eax, dword [eax]
push 0
push eax
call edi
cmp dword [ebp - 0x2c], 8
jb 0x40474c
push dword [ebp - 0x40]
call fcn.00404cd5
add esp, 4
push ecx
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.004047f0
mov esi, eax
cmp esi, 0xffffffff
jne 0x404720
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp dword [ebp - 0x14], 8
mov esi, eax
jb 0x404787
push dword [ebp - 0x28]
call fcn.00404cd5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00404cc6
mov esp, ebp
pop ebp
ret

Function at 0x4048e0
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
jne 0x404961
cmp dword [esi + 0xc], 0
lea eax, [esi + 0x10]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push eax
jne 0x404929
push 0
push esi
push 0x4049b0
push 0
push 0
call fcn.00405b7f
mov dword [esi + 4], eax
add esp, 0x18
xor eax, eax
cmp dword [esi + 4], eax
setne al
pop esi
ret
push 4
push esi
push 0x4049b0
push 0
push 0
call fcn.00405b7f
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x404957
push dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 4], eax
pop esi
setne al
ret
cmp dword [esi + 0x18], 0
je 0x404980
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x404979
xor eax, eax
pop esi
ret
mov dword [esi + 0x18], 0
mov eax, 1
pop esi
ret