joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4369c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push eax
push eax
push 1
push eax
mov dword [ebp - 4], esi
call dword [0x4730d8]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x436a0d
call dword [0x473100]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.0040d9a9
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x436ad4
mov esi, dword [ebp - 4]
xor eax, eax
push eax
push eax
push 1
push eax
call dword [0x4730d8]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x436a52
call dword [0x473100]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.0040d9a9
mov dword [ebp - 0xc], eax
test esi, esi
je 0x436a4f
push str.thread.exit_event
jmp 0x436ad9
mov esi, dword [ebp - 4]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
push ebx
push 0x43714c
push dword [ebp + 0xc]
push 0
call fcn.004588be
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [0x4730e8]
test eax, eax
jne 0x436abb
call dword [0x473100]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [ebp + 8], eax
call dword [edx]
test edi, edi
je 0x436a94
push edi
call esi
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x436aa2
push dword [eax + 8]
call esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.0040d9a9
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x436abb
push str.thread
jmp 0x436ad9
test edi, edi
je 0x436acb
push 0xffffffffffffffff
push edi
call dword [0x4730ec]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.thread.entry_event
lea eax, [ebp - 0x10]
push eax
call fcn.00432399
int3

Function at 0x43aea7
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x43aef0
push 0
push 0
call fcn.004588be
mov ecx, eax
add esp, 0x18
test ecx, ecx
jne 0x43aece
xor al, al
pop esi
ret
mov eax, dword [esi]
add eax, 4
lock inc dword [eax]
push ecx
mov ecx, dword [esi]
add ecx, 8
call fcn.0041b1f0
mov eax, dword [esi]
push dword [eax + 8]
call dword [0x4732f4]
mov al, 1
pop esi
ret
Function at 0x445b1c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x445b29
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00443df2
Function at 0x46262a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004624a9

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20
Function at 0x10005936
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10005945
pop dword [ebp - 0x44]
mov eax, 0x10005945
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xdf0f5435
add dword [ebp - 0x54], 0x6f42f116
mov dword [ebp - 0x50], 0x9b051e7d
sub dword [ebp - 0x50], 0x68d1d238
mov dword [ebp - 0x4c], 0x6ee82ef5
add dword [ebp - 0x4c], 0xdd641539
mov dword [ebp - 0x48], 0x6de726ed
sub dword [ebp - 0x48], 0x6de726ed
lea eax, [ebp - 0x54]
push eax
mov eax, 0xd1c49027
add eax, 0x3e3d6fdd
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4fce7cc8
sub dword [ebp - 0x54], 0xdb5c1372
mov dword [ebp - 0x50], 0x5f247312
sub dword [ebp - 0x50], 0x1db8119d
mov dword [ebp - 0x4c], 0xc6eb742c
add dword [ebp - 0x4c], 0x9c83f840
mov dword [ebp - 0x48], 0x37bea28e
add dword [ebp - 0x48], 0xc8415d72
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3f451
push 0
call eax
mov ecx, 0x1f89bae0
add ecx, 0xe07697e6
xor edi, edi
add edi, eax
mov esi, 0x1002bc00
add esi, dword [ebp - 0x44]
mov ebx, 0xabb6e35e
add ebx, 0x2e7b1281
sub dword [ebp - 0x28], eax
mov edx, dword [esi]
xor dword [ebp - 0x34], eax
xor edx, ebx
mov dword [edi], edx
add dword [ebp - 0x38], ecx
add edi, 0xe79cb549
sub edi, 0xe79cb545
add esi, 4
loop 0x10005a59
add eax, 0x4879892a
sub eax, 0x48784b3f
mov ebx, eax
add eax, 0xc37f2045
add eax, 0x3c80dfc0
mov ecx, 0xf368a405
add ecx, 0x1c975bfb
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4015f0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x40f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x10]
push esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x14]
push edi
mov edi, ecx
mov dword [ebp - 0x54], eax
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
push edi
lea eax, [ebp - 0x68]
push eax
call fcn.004024b0
mov ecx, dword [0x477e1c]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x477e1c]
jne 0x40169a
push 0x4c
call fcn.00409e14
add esp, 4
mov esi, eax
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00402520
mov ecx, dword [eax]
mov dword [ecx + 0xc], esi
push edi
call fcn.00402080
push dword [eax]
mov eax, dword [ebp - 0x54]
push str.Verdana
push 0
push dword [eax]
mov eax, dword [ebp - 0x58]
push 7
push 0
push 0
push 1
push dword [eax]
mov eax, dword [ebp - 0x5c]
push 0
push dword [eax]
push dword [0x477de4]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
push edi
call fcn.00402080
lea edx, [ebp - 0x50]
push edx
mov eax, dword [eax]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push edi
call fcn.00402080
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4016ff
push edi
call fcn.00402080
mov eax, dword [eax]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call fcn.00402080
push edi
mov eax, dword [eax]
mov dword [eax], 0
movups xmm0, xmmword [ebp - 0x50]
movups xmmword [ebp - 0x70], xmm0
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [ebp - 0x80], xmm0
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ebp - 0x90], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [ebp - 0x60], xmm0
call fcn.00402080
movups xmm0, xmmword [ebp - 0x70]
push edi
mov eax, dword [eax]
movups xmmword [eax + 4], xmm0
movups xmm0, xmmword [ebp - 0x80]
movups xmmword [eax + 0x14], xmm0
movups xmm0, xmmword [ebp - 0x90]
movups xmmword [eax + 0x24], xmm0
movq xmm0, qword [ebp - 0x60]
movq qword [eax + 0x34], xmm0
call fcn.00402080
push edi
mov eax, dword [eax]
mov byte [eax + 0x3c], 0
call fcn.00402080
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, dword [eax]
pop esi
call fcn.00409c21
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x402080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.004024b0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4020d6
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
int3
Function at 0x4022b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ac85
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x40f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.00402240
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x402333
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x402497
cmp dword [0x477e40], 0xfffffff
jne 0x40234a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x477e3c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.00409e14
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [0x477e40]
mov ebx, dword [0x477e54]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x40c950]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x40c950]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x477e38]
comiss xmm1, xmm0
jbe 0x402444
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0040ab80
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x402423
cmp ebx, 0x200
jae 0x402421
shl ebx, 3
cmp ebx, ecx
jae 0x402423
mov ebx, ecx
push ebx
call fcn.00402740
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00402240
mov ecx, dword [0x477e40]
mov edx, dword [eax]
jmp 0x40244a
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x477e40], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x477e50]
mov ecx, dword [0x477e44]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x477e3c]
jne 0x40247b
mov dword [ecx + eax*8], esi
jmp 0x40248a
cmp edi, edx
jne 0x402484
mov dword [ecx + eax*8], esi
jmp 0x40248e
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40248e
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ac85
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x40f00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.004024b0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4025a3
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x402707
cmp dword [0x477e20], 0xfffffff
jne 0x4025ba
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x477e1c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.00409e14
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [0x477e20]
mov ebx, dword [0x477e34]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x40c950]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x40c950]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x477e18]
comiss xmm1, xmm0
jbe 0x4026b4
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0040ab80
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x402693
cmp ebx, 0x200
jae 0x402691
shl ebx, 3
cmp ebx, ecx
jae 0x402693
mov ebx, ecx
push ebx
call fcn.004028c0
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004024b0
mov ecx, dword [0x477e20]
mov edx, dword [eax]
jmp 0x4026ba
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x477e20], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x477e30]
mov ecx, dword [0x477e24]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x477e1c]
jne 0x4026eb
mov dword [ecx + eax*8], esi
jmp 0x4026fa
cmp edi, edx
jne 0x4026f4
mov dword [ecx + eax*8], esi
jmp 0x4026fe
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4026fe
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x40276c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x477e3c]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x477e44
lea eax, [edi + edi]
push eax
call fcn.004020f0
mov ecx, dword [0x477e3c]
lea ebx, [edi - 1]
mov dword [0x477e50], ebx
mov dword [0x477e54], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x4028b0
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x477e44]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x402806
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x402879
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x402840
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x402838
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x402879
mov edi, eax
cmp dword [ebp - 4], eax
je 0x402856
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x40288a
cmp dword [ebp - 4], eax
jne 0x402847
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x4028b0
mov ebx, dword [0x477e50]
jmp 0x4027b3
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x402879
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4028c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x4028ec
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x477e1c]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x477e24
lea eax, [edi + edi]
push eax
call fcn.004020f0
mov ecx, dword [0x477e1c]
lea ebx, [edi - 1]
mov dword [0x477e30], ebx
mov dword [0x477e34], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x402a30
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x477e24]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x402986
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x4029f9
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x4029c0
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x4029b8
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x4029f9
mov edi, eax
cmp dword [ebp - 4], eax
je 0x4029d6
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x402a0a
cmp dword [ebp - 4], eax
jne 0x4029c7
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x402a30
mov ebx, dword [0x477e30]
jmp 0x402933
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x4029f9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1019a52c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a5c68]
jne 0x1019a536
repz ret
jmp fcn.1019bf9b

Function at 0x1019d0ef
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a5ad
and dword [ebp - 4], 0
cmp dword [0x101a6f98], 0
mov ebx, eax
jne 0x1019d1a0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d251
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d251
push eax
call fcn.1019a53b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101a6f98], eax
call esi
push eax
call fcn.1019a53b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101a6f9c], eax
call esi
push eax
call fcn.1019a53b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101a6fa0], eax
call esi
push eax
call fcn.1019a53b
pop ecx
mov dword [0x101a6fa8], eax
test eax, eax
je 0x1019d1a0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a53b
pop ecx
mov dword [0x101a6fa4], eax
mov eax, dword [0x101a6fa4]
cmp eax, ebx
je 0x1019d1f8
cmp dword [0x101a6fa8], ebx
je 0x1019d1f8
push eax
call fcn.1019a5b6
push dword [0x101a6fa8]
mov esi, eax
call fcn.1019a5b6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d1f8
test edi, edi
je 0x1019d1f8
call esi
test eax, eax
je 0x1019d1ef
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d1ef
test byte [ebp - 0xc], 1
jne 0x1019d1f8
or dword [ebp + 0x10], 0x200000
jmp 0x1019d231
mov eax, dword [0x101a6f9c]
cmp eax, ebx
je 0x1019d231
push eax
call fcn.1019a5b6
pop ecx
test eax, eax
je 0x1019d231
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d231
mov eax, dword [0x101a6fa0]
cmp eax, ebx
je 0x1019d231
push eax
call fcn.1019a5b6
pop ecx
test eax, eax
je 0x1019d231
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101a6f98]
call fcn.1019a5b6
pop ecx
test eax, eax
je 0x1019d251
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d253
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret