joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100533a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10227c10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x102db080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
add ecx, 0xc
call fcn.10050240
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0xc], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
xor edx, edx
xor eax, eax
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 0x20], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.10050080
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
add ecx, 0x134
call fcn.100796d0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], edx
push 0x102b1f7a
push 0x102b1f78
mov ecx, dword [ebp - 0x14]
call fcn.10054bf0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
push 0x102b1f6a
push 0x102b1f68
mov ecx, dword [ebp - 0x18]
call fcn.10054bf0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
push 0x102b286a
push str.lower
mov ecx, dword [ebp - 0x1c]
call fcn.10054bf0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
push 0x102b285e
push str.upper
mov ecx, dword [ebp - 0x20]
call fcn.10054bf0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
push 0x102b2852
push str.alpha
mov ecx, dword [ebp - 0x24]
call fcn.10054bf0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x140], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100823b0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102297e0
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x102db080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], ecx
mov ecx, dword [ebp - 0xe4]
call fcn.100847a0
cmp dword [ebp + 8], 0
jne 0x100823f9
xor al, al
jmp 0x100825dc
push 0x84
lea ecx, [ebp - 0xe0]
call fcn.1004c4a0
lea ecx, [ebp - 0xe0]
call fcn.10068ec0
mov dword [ebp - 4], 0
push 0x80
lea ecx, [ebp - 0xe0]
call fcn.10082130
lea eax, [ebp - 0x54]
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0xe0]
call fcn.1004f770
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x5c], 0x44
mov dword [ebp - 0x58], 0x80
mov ecx, dword [ebp - 0xe4]
add ecx, 0x4c
push ecx
lea edx, [ebp - 0x58]
push edx
mov eax, dword [ebp - 0xec]
push eax
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jne 0x10082508
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10082508
cmp dword [ebp - 0x5c], 0x44
jbe 0x100824ab
push 0x80004005
call fcn.10088c90
cmp dword [ebp - 0x58], 0x80
jbe 0x100824d4
mov edx, dword [ebp - 0x58]
push edx
lea ecx, [ebp - 0xe0]
call fcn.100822a0
lea ecx, [ebp - 0xe0]
call fcn.1004f770
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xe4]
add eax, 0x4c
push eax
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0xec]
push edx
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0xf4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x100825b2
mov ecx, dword [ebp - 0xe4]
mov byte [ecx + 0x48], 1
mov ecx, dword [ebp - 0xe4]
call fcn.10087160
mov dword [ebp - 0xf8], eax
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0xf4]
push eax
mov ecx, dword [ebp - 0xf8]
push ecx
mov edx, dword [ebp - 0xfc]
push edx
call dword [sym.imp.ADVAPI32.dll_CopySid]
test eax, eax
je 0x100825b2
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0xe4]
add ecx, 0x54
call fcn.10088230
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xe4]
add ecx, 0x50
call fcn.10088230
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0xe4]
add ecx, 0x5c
call fcn.10088230
mov byte [ebp - 0xe5], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.100820c0
mov al, byte [ebp - 0xe5]
jmp 0x100825dc
mov ecx, dword [ebp - 0xe4]
call fcn.100847a0
mov byte [ebp - 0xe6], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.100820c0
mov al, byte [ebp - 0xe6]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b9f43
mov esp, ebp
pop ebp
ret 8
Function at 0x10085930
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10228800
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x102db080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.10087060
test eax, eax
je 0x1008598b
mov ecx, dword [ebp + 0xc]
call fcn.10087060
test eax, eax
je 0x1008598b
mov ecx, dword [ebp + 8]
call fcn.10085d60
movzx eax, al
test eax, eax
je 0x1008598b
mov ecx, dword [ebp + 0xc]
call fcn.10085d60
movzx ecx, al
test ecx, ecx
jne 0x1008598f
xor al, al
jmp 0x100859ca
mov ecx, dword [ebp + 0xc]
call fcn.10087060
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
call fcn.10087060
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x100859c0
mov dword [ebp - 0x10], 1
jmp 0x100859c7
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x100876d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100876f4
xor eax, eax
jmp 0x10087774
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008770b
xor eax, eax
jmp 0x10087774
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10087757
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10087757
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1008772e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10087763
xor eax, eax
jmp 0x10087774
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10087771
xor eax, eax
jmp 0x10087774
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1008b260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10229cae
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102db080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.10088a70
mov ecx, eax
test ecx, ecx
je 0x1008b3a0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edi, 1
mov dword [ebp - 4], 0
mov ecx, edi
mov dword [ebp - 0x10], 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or ecx, eax
jge 0x1008b2df
push 0x104
mov ecx, esi
call fcn.10087d30
push dword [esi]
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esi]
test eax, eax
jne 0x1008b2fc
xor ecx, ecx
jmp 0x1008b313
push dword [eax - 8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1008b396
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x1008b396
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, dword [esi]
cmp dword [eax - 0xc], edx
jne 0x1008b383
sub edi, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or edi, eax
jge 0x1008b347
push 0x104
mov ecx, esi
call fcn.10087d30
push dword [esi]
push 0
push 0
push 0x8005
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esi]
test eax, eax
je 0x1008b371
push dword [eax - 8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
test eax, eax
js 0x1008b396
mov ecx, dword [esi]
cmp eax, dword [ecx - 8]
jg 0x1008b396
mov dword [ecx - 0xc], eax
xor edx, edx
mov ecx, dword [esi]
mov word [ecx + eax*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.10088c90
push 0x80004005
call fcn.10088c90
int3
Function at 0x1008b3b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10229ce5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x102db080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
jbe 0x1008b3ea
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x1008b40b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1008b3f7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1008b0a0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1008b43c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x1008b597
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.100b9beb
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.1008a290
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10236740]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10236740]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1008b539
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100ba260
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1008b51d
cmp eax, 0x200
jae 0x1008b51b
shl eax, 3
cmp eax, ecx
jae 0x1008b51d
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10090cb0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1008b0a0
mov edx, dword [eax]
jmp 0x1008b53c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1008b564
mov dword [ecx + eax*8], edi
jmp 0x1008b576
cmp esi, edx
jne 0x1008b56d
mov dword [ecx + eax*8], edi
jmp 0x1008b57a
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1008b57a
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100905a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022a6a7
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x102db080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
xor eax, eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 3
call fcn.10088a70
mov ecx, eax
test ecx, ecx
je 0x10090795
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ecx, 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], 3
sub ecx, dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [eax + 8]
sub eax, 0x104
mov dword [ebp - 0x1c], esi
or eax, ecx
jge 0x10090655
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.10087d30
mov esi, dword [ebp - 0x1c]
push esi
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test esi, esi
jne 0x1009066f
xor eax, eax
jmp 0x10090684
push dword [esi - 8]
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
test eax, eax
js 0x100907a9
cmp eax, dword [esi - 8]
jg 0x100907a9
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], eax
call fcn.10088a70
mov ecx, eax
test ecx, ecx
je 0x1009079f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
test esi, esi
je 0x100906da
test esi, 0xffff0000
jne 0x100906d6
movzx eax, si
lea ecx, [ebp - 0x14]
push eax
call fcn.10087a30
jmp 0x100906fc
test esi, esi
jne 0x100906de
xor ecx, ecx
jmp 0x100906f2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100906e3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.10088120
mov dword [ebp - 0x18], 1
lea edx, [esi - 0x10]
mov byte [ebp - 4], 6
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10090724
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Softativity_alist.dat
lea ecx, [ebp - 0x14]
call fcn.1004e380
mov eax, dword [ebp - 0x14]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10090740
sub edx, dword [ebp - 0x1c]
mov ecx, edi
sar edx, 1
push edx
push eax
call fcn.100854e0
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1009077f
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1009077f
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10088c90
push 0x80004005
call fcn.10088c90
push 0x80070057
call fcn.10088c90
int3
Function at 0x10090aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10090b11
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10090adf
cmp eax, 2
jne 0x10090afb
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x10090b0b
test ecx, ecx
je 0x10090b06
test cl, 1
jne 0x10090afb
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x10090b0b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10090cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x10090e2e
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp + 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10090b20
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10090e09
cmp dword [esi + 0x1c], 7
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jbe 0x10090d31
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 8]
xor edx, edx
add ecx, ecx
mov ebx, 0x811c9dc5
mov dword [ebp - 8], ecx
je 0x10090d5e
mov eax, dword [ebp - 4]
mov edi, ecx
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10090d47
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10090d7d
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10090dff
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004ead0
add esp, 8
test al, al
je 0x10090dba
mov ebx, dword [ebx]
cmp ebx, esi
je 0x10090db2
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10090dfc
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10090ddf
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004ead0
add esp, 8
test al, al
jne 0x10090e12
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10090dc1
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov esi, edi
cmp edi, eax
jne 0x10090d15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10090dfc
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1009cc80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 0x10237748
push dword [ebp + 8]
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov ebx, dword [ebp - 4]
add esp, 0xc
test ebx, ebx
jne 0x1009ccb7
lea eax, [ebx - 3]
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
push 2
push 0
push ebx
mov dword [ebp + 8], eax
call eax
add esp, 0xc
test eax, eax
je 0x1009ccd5
mov esi, 0xfffffffd
jmp 0x1009cd52
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
add esp, 4
test esi, esi
js 0x1009ccce
jne 0x1009cceb
xor esi, esi
jmp 0x1009cd52
push edi
lea eax, [esi + 1]
push 0x102385c4
push eax
lfence
call fcn.100ba4ba
mov edi, eax
add esp, 8
test edi, edi
jne 0x1009cd0b
lea esi, [eax - 2]
jmp 0x1009cd51
push 0
push 0
lfence
push ebx
mov byte [edi + esi], 0
call dword [ebp + 8]
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x1c
lfence
cmp eax, esi
je 0x1009cd3c
push edi
call fcn.100ba460
mov esi, 0xfffffffd
jmp 0x1009cd4e
mov ecx, dword [ebp - 8]
push eax
push edi
call fcn.1009ca90
push edi
mov esi, eax
call fcn.100ba460
add esp, 4
pop edi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4