joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea edi, [esi + 0x14]
mov dword [esi], 0x4052b8
cmp dword [edi], ebx
je 0x401f31
push str._mozilla.org_observer_service_1
mov edx, 0x4057b4
mov dword [ebp - 4], ebx
lea ecx, [ebp - 4]
call fcn.0040383d
mov eax, dword [ebp - 4]
test eax, eax
je 0x401f11
mov ecx, dword [eax]
push ebx
push str.profile_change_net_teardown
push ebx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_change_teardown
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push ebx
push str.profile_before_change2
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [edi]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor edx, edx
mov ecx, edi
call fcn.004038ec
mov eax, dword [ebp - 4]
test eax, eax
je 0x401f31
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x401f68
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push ebx
mov dword [esi + 0xc], ebx
call dword [sym.imp.xul.dll_NS_ShutdownXPCOM]
pop ecx
mov ecx, eax
shr ecx, 0x1f
test cl, 1
je 0x401f68
push eax
push str.XPCOM_shutdown_failed_with_code_0x_x
call fcn.00402e02
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esi + 8]
push str.Finished_running__s_tests._n
call fcn.00403567
pop ecx
pop ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x401f84
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x401f91
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [edi]
test ecx, ecx
je 0x401f9d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebx
test ecx, ecx
je 0x401fad
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esp, ebp
pop ebp
ret
Function at 0x4087f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f720
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [ebx], 0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 4]
sub eax, 0x200
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40887d
push 0x10
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40892a
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40892a
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x40892a
mov eax, dword [edi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x40896c
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
je 0x4088ae
mov eax, dword [edi + 8]
cmp eax, 0x58
je 0x4088ae
cmp eax, 0x43
je 0x4088ae
cmp eax, 0x56
jne 0x40892a
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
je 0x4088c9
mov eax, dword [edi + 8]
cmp eax, 0x25
je 0x40892a
cmp eax, 0x27
je 0x40892a
cmp dword [edi + 4], 0x100
jne 0x40896c
mov eax, dword [edi + 8]
cmp eax, 8
jne 0x408922
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.00412890
mov esi, eax
mov dword [ebp - 0x54], esi
test esi, esi
je 0x4088f8
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
test esi, esi
je 0x408937
mov dl, 1
mov ecx, esi
call fcn.00412970
test al, al
je 0x408937
mov byte [ebp - 4], 4
mov byte [ebp - 4], 0
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, dword [edi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja 0x40896c
mov dword [ebx], 1
mov eax, 1
jmp 0x408975
mov dword [ebx], 1
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
test esi, esi
je 0x40894f
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov eax, 1
jmp 0x408975
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005214e1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409990
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53fc28
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x409aca
mov eax, dword [0x5d63bc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00409d90
mov dword [ebp - 4], 0
mov edx, eax
mov ecx, 0x5d63bc
call fcn.00409d00
mov bl, al
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x409a11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x409a6a
mov eax, dword [0x5d63bc]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.00409f20
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409aab
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x409aab
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409a6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00409e50
mov dword [ebp - 4], 6
mov ecx, 0x57deec
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409ae0
test dx, dx
je 0x409aa7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409ae0
add eax, 4
add ecx, 4
test dx, dx
jne 0x409a85
xor edi, edi
jmp 0x409ae5
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x409aca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb edi, edi
or edi, 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x409b04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x412200
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540b50
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x412249
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412235
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x412282
nop dword [eax]
cmp esi, edx
jae 0x412235
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x412270
cmp esi, edx
jae 0x412235
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
push edi
cmp dword [ecx + 0x14], 8
mov edi, dword [ecx + 0x10]
jb 0x413d72
mov ecx, dword [ecx]
add edi, edi
xor ebx, ebx
xor esi, esi
mov eax, 0x811c9dc5
lea edx, [edi + ecx]
cmp ecx, edx
cmova edi, ebx
test edi, edi
je 0x413da3
nop dword [eax]
movzx edx, byte [ecx]
lea ecx, [ecx + 1]
xor edx, eax
inc esi
imul eax, edx, 0x1000193
cmp esi, edi
jne 0x413d90
pop edi
pop esi
pop ebx
ret 4

Function at 0x414b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541915
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 4
mov eax, dword [ebp + 8]
mov dword [esi + 0x24], 0x57fc44
mov dword [esi], 0x57fcac
mov dword [esi + 0x24], 0x57fc78
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov byte [ebp - 4], 6
mov byte [esi + 0x58], 1
mov dword [esi + 0x5c], 0
mov byte [esi + 0x60], 1
mov dword [esi + 0x64], 0xffffffff
mov byte [esi + 0x68], 0
mov dword [esi + 0x6c], 0xffffffff
mov word [esi + 0x70], 1
mov byte [esi + 0x72], 0
mov dword [esi + 0x74], 0
mov byte [esi + 0x78], 0
call fcn.00490ee0
mov edi, eax
mov eax, dword [0x5d6c38]
test al, 1
jne 0x414c9c
or eax, 1
mov dword [0x5d6c38], eax
mov byte [ebp - 4], 7
push 0x104
push 0
push 0x5d6c4c
mov dword [0x5d6c40], 6
mov dword [0x5d6c44], 0
mov dword [0x5d6c48], 0
call fcn.00523880
add esp, 0xc
mov dword [0x5d6d50], 1
mov word [0x5d6d54], 0
push 0
push 0x100
push 0x5d6c50
call fcn.00498f10
add esp, 0xc
mov byte [ebp - 4], 6
mov eax, dword [edi]
cmp eax, dword [0x5d6c40]
jae 0x414caa
xor al, al
jmp 0x414cdf
ja 0x414cdd
mov eax, dword [edi + 4]
cmp eax, dword [0x5d6c44]
jae 0x414cbb
xor al, al
jmp 0x414cdf
ja 0x414cdd
mov eax, dword [edi + 0xc]
cmp eax, dword [0x5d6c4c]
jae 0x414ccc
xor al, al
jmp 0x414cdf
ja 0x414cdd
mov eax, dword [edi + 8]
cmp eax, dword [0x5d6c48]
jae 0x414cdd
xor al, al
jmp 0x414cdf
mov al, 1
test al, al
je 0x414cf1
call dword [sym.imp.UxTheme.dll_BufferedPaintInit]
test eax, eax
sete al
mov byte [esi + 0x78], al
mov byte [ebp - 4], 8
mov byte [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x416ab0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x416b2a
mov esi, dword [esp + 0x10]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x416ae5
push edi
mov ecx, esi
call fcn.00412580
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x416b0c
mov ecx, dword [esi]
test ecx, ecx
je 0x416b10
push dword [ecx - 8]
push ecx
call fcn.005295a5
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x416b2a
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x416b2a
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push 0x80070057
call fcn.004126a0
int3
Function at 0x423eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, ecx
push edi
xor edi, edi
mov eax, 0x811c9dc5
lea edx, [esi + 4]
cmp edx, esi
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
cmp esi, edx
ja 0x423ee5
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x423ed2
and eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x424050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, 0x811c9dc5
lea esi, [edi + 8]
lea edx, [esi + 4]
cmp edx, esi
sbb ebp, ebp
and ebp, 0xfffffffc
add ebp, 4
cmp esi, edx
ja 0x42408b
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc ebx
imul eax, ecx, 0x1000193
cmp ebx, ebp
jne 0x424078
mov edx, dword [esp + 0x10]
mov ecx, dword [edx + 0x18]
and ecx, eax
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x4240c4
cmp eax, edi
jne 0x4240bc
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4240cc
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4240cc
cmp eax, edi
jne 0x4240d0
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
call fcn.005214f2
mov eax, dword [esp + 0x20]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x42d840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545b7f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.00521500
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [esi], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
mov dword [ebp - 4], 0xffffffff
push 0
push 0
push esi
push 0x42d7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
jne 0x42d8b4
push 8
push esi
call fcn.005214f2
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov edx, 0x811c9dc5
push ebx
push ebp
push esi
push edi
lea edi, [eax + 8]
mov dword [esp + 0x10], ecx
lea esi, [edi + 4]
xor ebx, ebx
cmp esi, edi
sbb ebp, ebp
and ebp, 0xfffffffc
add ebp, 4
cmp edi, esi
ja 0x433d6b
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor ecx, edx
inc ebx
imul edx, ecx, 0x1000193
cmp ebx, ebp
jne 0x433d58
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx + 0x18]
and ecx, edx
mov edx, dword [ebx + 0xc]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x433da5
cmp ecx, eax
jne 0x433d9d
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x433dad
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x433dad
cmp ecx, eax
jne 0x433dad
mov ecx, dword [eax]
mov dword [edx], ecx
mov esi, dword [esp + 0x18]
lea ecx, [ebx + 4]
push eax
push esi
call fcn.00433fb0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4340f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54724b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5d0074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 8]
mov dword [ebx + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 2
mov edx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 0x20], edx
mov dword [ebp - 4], 4
lea edi, [ebx + 0x24]
mov dword [edi], method.std::_Facet_base.virtual_4
mov byte [ebp - 4], 5
lea esi, [ebx + 0x2c]
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0x14]
mov dword [ebx + 0x28], 0x57fd78
lea eax, [ecx + 8]
mov dword [ebp - 0x18], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ecx + 4], 0
mov dword [ebp - 0x1c], eax
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 7
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 8
mov dword [ecx + 0x20], edx
mov byte [ebp - 4], 0xa
mov dword [ecx], 0x582e4c
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x3c]
call fcn.00435080
mov byte [ebp - 4], 0xc
mov byte [esi + 0x5c], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov byte [ebp - 4], 0xd
lea esi, [ebx + 0xa0]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebx], 0x582f50
mov dword [edi], 0x582e70
mov dword [ebx + 0x28], 0x582e5c
mov dword [ebx + 0x90], ecx
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x9c], 0
mov eax, dword [ecx]
mov dword [ebp + 8], esi
call dword [eax + 4]
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], edi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], ax
mov byte [ebp - 4], 0xe
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov byte [ebp - 4], 0xf
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 7
mov word [esi + 0x38], ax
mov byte [ebp - 4], 0x10
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], 7
mov word [esi + 0x50], ax
mov byte [ebp - 4], 0x11
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov byte [ebp - 4], 0x12
mov byte [esi + 0x74], al
mov byte [ebp - 4], 0x13
mov dword [ebx + 0x128], eax
mov dword [ebx + 0x12c], 7
mov word [ebx + 0x118], ax
mov byte [ebp - 4], 0x14
mov dword [ebx + method.std::_Iostream_error_category.virtual_0], 0x5910b8
mov dword [ebx + 0x134], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43cc00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54925f
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x88], edi
cmp dword [ebp + 8], 1
je 0x43cc50
mov dword [edi + 0x1cc], 0
xor eax, eax
jmp 0x43cde9
mov dword [ebp - 4], 0
wait
mov esi, dword [edi + 0x280]
mov ebx, dword [edi + 0x284]
cmp esi, ebx
je 0x43cd72
mov dword [ebp - 0x98], esi
cmp esi, ebx
je 0x43cd82
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x597108]
lahf
test ah, 0x44
jnp 0x43cd7a
xorps xmm0, xmm0
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0x94], xmm0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x43ccb9
mov eax, dword [esi]
push 0
lea ecx, [ebp - 0xb4]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x94]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x90]
mov dword [esi + 0x24], eax
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x94]
call fcn.0053e6b0
mulsd xmm0, qword [0x597120]
mov eax, dword [esi + 0x28]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm0, xmm1
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x43cd7a
mov edi, dword [edi + 0x1d4]
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
push 0x580384
lea ecx, [ebp - 0x84]
call fcn.004064f0
mov byte [ebp - 4], 1
push str.OutOfDiskSpace
lea ecx, [ebp - 0x6c]
call fcn.004064f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
call esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.00407b40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.00407b40
mov eax, 1
wait
jmp 0x43cde9
add esi, 0x30
jmp 0x43cc6c
mov edi, dword [edi + 0x1d4]
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
push 0x5837c4
lea ecx, [ebp - 0x6c]
call fcn.004064f0
mov byte [ebp - 4], 3
push str.OutOfDiskSpace
lea ecx, [ebp - 0x84]
call fcn.004064f0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x84]
push eax
mov ecx, edi
call esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x84]
call fcn.00407b40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.00407b40
wait
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005214e1
mov esp, ebp
pop ebp
ret 4
Function at 0x43e1a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ax, word [esp + 8]
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
mov ecx, 0x2710
sub ax, cx
push esi
push edi
cmp ax, cx
ja 0x43e2d9
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
mov edi, eax
mov esi, 4
movzx eax, al
shl eax, 0x10
shr edi, 0x10
or edi, eax
mov eax, 0x811c9dc5
mov dword [esp + 0x10], edi
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
sub esi, 1
jne 0x43e1e2
mov ecx, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x18]
and ecx, eax
mov eax, dword [ebp + 0x20]
mov ebx, dword [eax + ecx*8]
mov edx, ebx
lea ecx, [eax + ecx*8]
cmp ebx, esi
jne 0x43e210
mov eax, esi
jmp 0x43e215
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp edx, eax
je 0x43e222
cmp dword [edx + 8], edi
je 0x43e224
mov edx, dword [edx]
jmp 0x43e208
mov edx, esi
cmp edx, esi
jne 0x43e2d9
push dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [ebp + 0x14]
call fcn.00440f80
movzx eax, word [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x38]
mov edi, dword [eax]
lea eax, [esp + 0x10]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.00428b60
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebp + 0x3c]
sub ecx, eax
cmp ecx, 1
jb 0x43e2e5
inc eax
lea ecx, [ebp + 0x34]
mov dword [ebp + 0x3c], eax
mov dword [edi + 4], edx
mov dword [ebx], edx
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004288f0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
cmp dword [ecx + 8], eax
je 0x43e2c2
mov edx, dword [esp + 0x24]
pop edi
mov dword [eax], edx
mov dx, word [esp + 0x24]
pop esi
mov word [eax + 4], dx
mov al, 1
add dword [ecx + 4], 6
pop ebp
pop ebx
add esp, 0x10
ret 0xc
lea edx, [esp + 0x24]
push edx
push eax
call fcn.004409a0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0xc
push str.list_T__too_long
call fcn.0051f521
int3
Function at 0x43fef0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5497e0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5d0074]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ecx, dword [ebp + 0x14]
test esi, esi
je 0x43ff32
lea eax, [esi - 0x178]
mov dword [ebp - 0x54], eax
jmp 0x43ff39
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0
cmp word [ebp + 8], 1
jne 0x43ffcd
movzx edi, word [ebp + 0xc]
mov dword [ebp - 0x5c], edi
mov eax, 0x811c9dc5
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x58]
cmp edx, ecx
je 0x43ff7e
movzx ecx, byte [edx]
xor eax, ecx
mov dword [ebp - 0x60], eax
imul eax, eax, 0x1000193
inc edx
jmp 0x43ff60
mov ecx, dword [esi + 0x4c]
and ecx, eax
lea edx, [ecx*8]
mov ebx, dword [esi + 0x40]
mov eax, dword [edx + ebx]
mov ecx, dword [esi + 0x38]
cmp dword [edx + ebx], ecx
je 0x43ff9e
mov ecx, dword [edx + ebx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x58], ecx
cmp eax, ecx
je 0x43ffb3
cmp dword [eax + 8], edi
jne 0x43ffaf
mov ecx, dword [esi + 0x38]
jmp 0x43ffb8
mov eax, dword [eax]
jmp 0x43ff90
mov eax, dword [esi + 0x38]
mov ecx, eax
cmp eax, ecx
je 0x43ffcd
push 0
push edi
push 0x69a
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005214e1
mov esp, ebp
pop ebp
ret 0x10