joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414075
Capabilities:
Get disk information

Disassembly:
mov eax, 0x41f43f
call sub.msvcrt.dll__EH_prolog
sub esp, 0x45c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
inc esi
push 0x4244a8
lea ecx, [ebp + 0x70]
mov dword [ebp - 4], esi
call fcn.0040e79b
push eax
call sub.msvcrt.dll_strtok_s
add esp, 0xc
xor ebx, ebx
push ebx
push 0x4244ac
lea ecx, [ebp + 0x64]
mov dword [ebp - 0x10], eax
xor edi, edi
mov dword [ebp - 0x14], ebx
call fcn.0040e79b
push eax
call dword [0x63e098]
test eax, eax
je 0x4140cd
mov edi, esi
push ebx
push 0x4244bc
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
call dword [0x63e098]
test eax, eax
je 0x4140eb
mov edi, esi
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
jmp 0x41426a
cmp edi, ebx
je 0x4141fd
lea eax, [ebp - 0x80]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x80]
cmp byte [ebp - 0x80], bl
je 0x414255
push 0x3e8
lea eax, [ebp - 0x468]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x14], ebx
je 0x414157
cmp eax, 2
jne 0x414157
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414173
lea ecx, [ebp + 0x64]
call fcn.0040e79b
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x468]
push eax
call fcn.0040fbb0
add esp, 0xc
push eax
lea eax, [ebp - 0x468]
push eax
call dword [0x63e1a8]
push ebx
push dword [ebp + 0x88]
lea eax, [ebp - 0x468]
push edi
push dword [ebp + 0x84]
lea ecx, [ebp + 0x58]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push dword [ebp - 0x10]
push eax
call fcn.0040e79b
push eax
push 0x42424f
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
push esi
call dword [0x63e020]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x414113
jmp 0x414255
push ebx
push dword [ebp + 0x88]
lea ecx, [ebp + 0x64]
push ebx
push dword [ebp + 0x84]
push dword [ebp + 0x80]
push ebx
push dword [ebp + 0x7c]
push eax
call fcn.0040e79b
push eax
lea ecx, [ebp + 0x58]
call fcn.0040e79b
push eax
push 0x424252
lea ecx, [ebp + 0x8c]
call fcn.0040e79b
push eax
sub esp, 0x50
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040117e
call fcn.00413ca3
add esp, 0x80
lea eax, [ebp - 0x18]
push eax
push 0x4244f4
push ebx
call sub.msvcrt.dll_strtok_s
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x4140f3
push 4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f78b
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0040113a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x58]
call fcn.004115c2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x418ef7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c1b0]
jne 0x418f01
repz ret
jmp fcn.0041bbef
Function at 0x41c3c6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041881a
and dword [ebp - 0x14], 0
cmp dword [0x63ed7c], 0
mov dword [ebp - 0x18], eax
jne 0x41c479
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41c521
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41c521
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x63ed7c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x63ed80], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x63ed84], eax
call edi
push eax
call esi
mov dword [0x63ed8c], eax
test eax, eax
je 0x41c479
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x63ed88], eax
mov eax, dword [0x63ed88]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41c4d2
cmp dword [0x63ed8c], ecx
je 0x41c4d2
push eax
call esi
push dword [0x63ed8c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41c4d2
test ebx, ebx
je 0x41c4d2
call edi
test eax, eax
je 0x41c4c9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41c4c9
test byte [ebp - 8], 1
jne 0x41c4d2
or dword [ebp + 0x10], 0x200000
jmp 0x41c505
mov eax, dword [0x63ed80]
cmp eax, dword [ebp - 0x18]
je 0x41c505
push eax
call esi
test eax, eax
je 0x41c505
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41c505
mov eax, dword [0x63ed84]
cmp eax, dword [ebp - 0x18]
je 0x41c505
push eax
call esi
test eax, eax
je 0x41c505
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x63ed7c]
call esi
test eax, eax
je 0x41c521
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41c523
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418ef7
leave
ret
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40369c
pop dword [ebp - 0x1c]
mov eax, 0x1f70ae29
add eax, 0xe0cf8873
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8e2617ca
sub dword [ebp - 0x2c], 0x3fd3d27f
mov dword [ebp - 0x28], 0xc3995616
add dword [ebp - 0x28], 0x6e99f62f
mov dword [ebp - 0x24], 0x97423b06
add dword [ebp - 0x24], 0xb50a0928
mov dword [ebp - 0x20], 0xcbb8c111
add dword [ebp - 0x20], 0x34473eef
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x1ba9eb0f
sub eax, 0x1b697af3
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x69ac4495
add dword [ebp - 0x2c], 0xac624c1
mov dword [ebp - 0x28], 0x56b38601
sub dword [ebp - 0x28], 0x1547248c
mov dword [ebp - 0x24], 0x121ab21
sub dword [ebp - 0x24], 0x9db23eb5
mov dword [ebp - 0x20], 0xfdc9b0d
sub dword [ebp - 0x20], 0xfdc9b0d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x8861c5e8
sub eax, 0x882155c8
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37fc5
push 0
call eax
mov ecx, 0x50b54356
sub ecx, 0x50b4fa3e
xor esi, esi
add esi, eax
mov edx, 0x6bf14c81
sub edx, 0x6bb08481
add edx, dword [ebp - 0x1c]
mov ebx, 0xf70e6f05
add dword [ebp - 0x14], 0x6fcc11c4
mov edi, dword [edx]
sub dword [ebp - 0xc], edx
xor edi, ebx
mov dword [esi], edi
xor dword [ebp - 0x18], 0x5b92426
add esi, 4
add edx, 4
loop 0x4037ba
add eax, 0xe447d945
add eax, 0x1bb93dee
xor ebx, ebx
add ebx, eax
add eax, 0x306145ea
add eax, 0xcf9eba1b
mov ecx, 0x827faa48
add ecx, 0x7dc055b8
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x406291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4261d0]
jne 0x40629b
repz ret
jmp fcn.0040871c

Function at 0x40adfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004074b2
and dword [ebp - 0x14], 0
cmp dword [0x427a30], 0
mov dword [ebp - 0x18], eax
jne 0x40aeaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40af57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40af57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427a30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427a34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427a38], eax
call edi
push eax
call esi
mov dword [0x427a40], eax
test eax, eax
je 0x40aeaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427a3c], eax
mov eax, dword [0x427a3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af08
cmp dword [0x427a40], ecx
je 0x40af08
push eax
call esi
push dword [0x427a40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af08
test ebx, ebx
je 0x40af08
call edi
test eax, eax
je 0x40aeff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aeff
test byte [ebp - 8], 1
jne 0x40af08
or dword [ebp + 0x10], 0x200000
jmp 0x40af3b
mov eax, dword [0x427a34]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40af3b
mov eax, dword [0x427a38]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427a30]
call esi
test eax, eax
je 0x40af57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40af59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
leave
ret

Function at 0x401910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x10011fa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
movzx eax, dl
mov edi, dword [eax*4 + 0x1010b7f0]
lea eax, [ebp - 4]
add edi, dword [0x116ee8bc]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [ebp - 4]
mov byte [edi], 0xff
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10017b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x10017b6b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10017b54
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x10017e00
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f0405
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1012c208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.10018240
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10017e6f
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x10017fcd
cmp dword [0x117a5738], 0xfffffff
je 0x10017fe3
mov dword [ebp - 0x28], 0x117a5734
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100bfff8
mov cl, byte [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov byte [esi + 8], cl
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x117a5738]
mov edi, dword [0x117a574c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101152d0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101152d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x117a5730]
comiss xmm1, xmm0
jbe 0x10017f78
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call fcn.100ebd20
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100ed1c0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10017f58
cmp edi, 0x200
jae 0x10017f56
shl edi, 3
cmp edi, ecx
jae 0x10017f58
mov edi, ecx
push edi
call fcn.100180a0
push dword [ebp - 0x14]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10018240
mov ecx, dword [0x117a5738]
mov edx, dword [eax]
jmp 0x10017f7b
mov edx, dword [ebp - 0x20]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x117a5738], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x117a5748]
and eax, dword [ebp - 0x14]
mov ecx, dword [0x117a573c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x117a5734]
mov esi, dword [ebp - 0x24]
jne 0x10017fb0
mov dword [ecx + eax*8], esi
jmp 0x10017fc0
cmp dword [ecx + eax*8], edx
jne 0x10017fba
mov dword [ecx + eax*8], esi
jmp 0x10017fc4
cmp dword [ecx + eax*8 + 4], edi
jne 0x10017fc4
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.100a98ad
int3
Function at 0x100180a0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x18
bsr ecx, eax
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebx + 8]
cmp ecx, eax
ja 0x10018226
lea eax, [ecx - 1]
mov esi, dword [0x117a5734]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x117a573c
lea eax, [edi + edi]
push eax
call fcn.10017d10
mov ecx, dword [0x117a5734]
lea eax, [edi - 1]
mov dword [0x117a5748], eax
mov dword [0x117a574c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100181f0
nop dword [eax]
movzx eax, byte [ecx + 8]
mov edx, dword [edx]
xor eax, 0x811c9dc5
imul edi, eax, 0x1000193
mov eax, dword [0x117a573c]
mov dword [ebp - 0xc], edx
and edi, dword [0x117a5748]
lea eax, [eax + edi*8]
mov edi, dword [eax]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edi
cmp edi, esi
jne 0x10018158
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100181e6
mov eax, dword [eax + 4]
mov dl, byte [ecx + 8]
cmp dl, byte [eax + 8]
mov edx, dword [ebp - 0xc]
jne 0x1001819e
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, ecx
je 0x10018196
mov eax, dword [ecx + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [eax], edx
mov edi, dword [edx + 4]
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], ecx
jmp 0x100181e6
mov edi, eax
cmp dword [ebp - 0x10], eax
je 0x100181ba
mov eax, dword [eax + 4]
mov edi, eax
mov dl, byte [ecx + 8]
cmp dl, byte [eax + 8]
mov edx, dword [ebp - 0xc]
je 0x100181fb
cmp dword [ebp - 0x10], eax
jne 0x100181a5
mov eax, dword [ecx + 4]
mov dword [ebp - 0xc], eax
mov dword [eax], edx
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
mov dword [eax], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], esi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], esi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], ecx
mov esi, dword [ebp - 8]
mov ecx, edx
cmp edx, esi
jne 0x10018120
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [eax], edx
mov edi, dword [edx + 4]
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov edi, dword [ebp - 0x14]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
jmp 0x100181e3
push str.invalid_hash_bucket_count
call fcn.100a98ad
int3
Function at 0x10018460
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [esi], 0
test edx, edx
jne 0x1001847f
xor al, al
mov byte [esi + 0xc], al
mov eax, esi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
push ecx
push 0x40
push edx
push eax
mov dword [esi + 4], edx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [esi + 0xc], al
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x100184b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x100184d9
mov byte [ebp - 8], 0
jmp 0x100184f9
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.100c2e00
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10018523
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10018530
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x10018557
xor bl, bl
jmp 0x1001857c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.100c2e00
add esp, 0xc
test bl, bl
je 0x100185a5
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100185b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, edx
mov dword [ebp - 0x14], 0
test esi, esi
jne 0x100185c9
mov byte [ebp - 8], dl
jmp 0x100185e6
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
push esi
push 0x90
push dword [ebp + 8]
call fcn.100c1d40
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10018614
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10018620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 5], cl
test eax, eax
je 0x1001866e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 5]
movzx eax, cl
sub eax, 0xe8
je 0x100186f1
sub eax, 1
je 0x100186f1
sub eax, 0x16
jne 0x100186e2
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.1002e7c0
add esp, 4
cmp al, 0x15
je 0x1001869b
cmp al, 0x25
jne 0x100186e2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x100186d5
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, 1
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.1002e710
add esp, 4
add eax, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret