joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40db30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jle 0x40db55
push esi
mov esi, dword [ebp + 8]
mov ecx, 0x4bb248
mov dword [esi + eax*4], ecx
test ecx, ecx
je 0x40db57
inc eax
add ecx, 0x51
cmp eax, edx
jl 0x40db45
pop esi
pop ebp
ret
push 0x10
push 0
push str.Cannot_allocate_memory_from_process_default_heap_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40e100
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push bind
push bind
push bind
push bind
push 1
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4bb19c], eax
test eax, eax
jne 0x40e15c
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0
push 0x40185c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EnumChildWindows]
test eax, eax
je 0x40e156
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4019d3
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x4bb23c], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e210
Capabilities:
Enumerate gui resources
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49152b
mov eax, dword fs:[0]
push eax
mov eax, 0x1134
call fcn.0041c7e0
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x497390]
movq xmm0, qword [str._unknown_]
push 0xfa
xor ebx, ebx
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push ebx
push eax
movq qword [ebp - 0x114], xmm0
call fcn.0041c510
add esp, 0xc
lea eax, [ebp - 0x1128]
push eax
push 0x1000
lea eax, [ebp - 0x1114]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x40e461
mov eax, dword [ebp - 0x1128]
shr eax, 2
xor edi, edi
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1118], edi
test eax, eax
je 0x40e45f
jmp 0x40e2c0
cmp dword [ebp + edi*4 - 0x1114], 0
je 0x40e450
mov esi, dword [ebp + edi*4 - 0x1114]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x40e44a
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40e43d
lea eax, [ebp - 0x1140]
push eax
push 4
lea eax, [ebp - 0x1124]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x40e43d
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x1124]
push edi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x40e43d
lea eax, [ebp - 0x114]
push eax
push str.smmon.exe
call fcn.00422a30
add esp, 8
test eax, eax
jne 0x40e43d
mov eax, dword [ebp - 0x1118]
lea ecx, [ebp - 0x1138]
mov eax, dword [ebp + eax*4 - 0x1114]
mov dword [ebp - 0x113c], eax
lea eax, [ebp - 0x1119]
push eax
call fcn.00401456
lea eax, [ebp - 0x113c]
push eax
push 0x401825
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x40e40c
mov eax, dword [ebp - 0x1130]
sub eax, dword [ebp - 0x1134]
xor esi, esi
sar eax, 2
test eax, eax
je 0x40e3de
lea esp, [esp]
push esi
lea ecx, [ebp - 0x1138]
call fcn.004014e7
push 0
push 0
push 0x10
push dword [eax]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 0x1130]
sub eax, dword [ebp - 0x1134]
inc esi
sar eax, 2
cmp esi, eax
jb 0x40e3b0
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x7d0
push edi
call esi
test eax, eax
je 0x40e405
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7d0
push edi
call esi
test eax, eax
jne 0x40e42b
mov ebx, 1
jmp 0x40e42b
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x7d0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
mov eax, 1
cmove ebx, eax
lea ecx, [ebp - 0x113c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401258
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1118]
mov eax, dword [ebp - 0x1120]
inc edi
mov dword [ebp - 0x1118], edi
cmp edi, eax
jb 0x40e2c0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
Function at 0x40e7b0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x63
xor esi, esi
lea eax, [ebp - 0x67]
push esi
push eax
mov byte [ebp - 0x68], 0
call fcn.0041c510
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
push str.MonitorSockDidIPChange__
push 0x495ff1
push esi
push 3
call fcn.004017f8
add esp, 0x10
lea eax, [ebp - 0xcc]
push 0x64
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40e83c
mov eax, dword [eax + 0xc]
push 0x64
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0041c3e0
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, str.127.0.0.1
lea eax, [ebp - 0x68]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e870
test dl, dl
je 0x40e86c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e870
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e850
xor eax, eax
jmp 0x40e875
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e8b0
mov ecx, 0x4bc2f0
lea eax, [ebp - 0x68]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e8a1
test dl, dl
je 0x40e89d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e8a1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e881
xor eax, eax
jmp 0x40e8a6
sbb eax, eax
or eax, 1
mov ecx, 1
test eax, eax
cmovne esi, ecx
push 0x4bc2f0
lea eax, [ebp - 0x68]
push eax
push esi
push str.MonitorSockDidIPChange___ret_d_new_s._old_s.
push 0x495ff1
push 3
push 3
call fcn.004017f8
add esp, 0x1c
test esi, esi
je 0x40e8f1
xor edx, edx
jmp 0x40e8e0
mov cl, byte [ebp + edx - 0x68]
mov byte [edx + 0x4bc2f0], cl
lea edx, [edx + 1]
test cl, cl
jne 0x40e8e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret

Function at 0x40eb70
Capabilities:
Create thread

Disassembly:
push 0x4bc368
push 0
push 0x495ff1
push 0x40e9a0
push 0x2000
push 0
call fcn.004225c0
add esp, 0x18
ret
Function at 0x4108f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491600
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4b6e40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x4018b6
push dword [ebp + 8]
mov dword [ebp - 4], 0
push 0
mov dword [esi], vtable.SOL::Thread.0
call fcn.004225c0
add esp, 0x18
mov dword [esi + 0x10], eax
test eax, eax
je 0x41096e
cmp eax, 0xffffffff
je 0x41096e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], 0
push 0x1a
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], vtable.SOL::Exception.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
call fcn.00422ed0
push str.Failed_to_create_a_thread
push 0x1a
push eax
mov dword [ebp - 0x1c], eax
call fcn.00421100
add esp, 0x10
lea eax, [ebp - 0x24]
push 0x4b2860
push eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x24], vtable.SOL::InvalidHandleException.0
call fcn.00423800
int3

Function at 0x410a10
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491640
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x4b6e40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
movzx edx, byte [ebp + 0xc]
lea eax, [esi + 8]
push eax
movzx eax, byte [ebp + 8]
shl dx, 8
or dx, ax
movzx eax, dx
push eax
mov dword [ebp - 4], 0
mov dword [esi], vtable.SOL::WSAInitializer.0
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x410ac3
mov dword [ebp - 0x20], 0
push 0x25
mov byte [ebp - 4], 1
mov dword [ebp - 0x24], vtable.SOL::Exception.0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.00422ed0
push str.WSAInitializerWSAInitializer_Failed
push 0x25
push eax
mov dword [ebp - 0x1c], eax
call fcn.00421100
add esp, 0x10
lea eax, [ebp - 0x24]
push 0x4b27fc
push eax
mov byte [ebp - 4], 0
call fcn.00423800
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4121d0
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push str.6510
call fcn.0041c260
movzx esi, ax
call fcn.004019ec
push 0x1e
lea eax, [ebp - 0x24]
push eax
push str.WINRSH_PORT
push 0
call fcn.004017d5
add esp, 0x14
test eax, eax
jne 0x412222
lea eax, [ebp - 0x24]
push eax
call fcn.0041c260
add esp, 4
movzx esi, ax
push str.Initializing_Windows_Sockets_DLL
push 0x495ff1
push 0
push 3
call fcn.004017f8
push 0x190
lea eax, [ebp - 0x22c]
push 0
push eax
call fcn.0041c510
add esp, 0x1c
lea eax, [ebp - 0x22c]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x412278
call fcn.0040182a
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
movq qword [0x4bf3c0], xmm0
mov eax, 2
push esi
movq qword [0x4bf3c8], xmm0
mov dword [0x4bf3c4], 0
mov word [0x4bf3c0], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x4bf3c2], ax
movsx eax, si
push eax
lea eax, [ebp - 0x9c]
push str.Opening_socket_using_port__d
push eax
call fcn.0041bff0
lea eax, [ebp - 0x9c]
push eax
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x1c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4b6d9c], eax
cmp eax, 0xffffffff
je 0x412261
push str.Setting_up_socket_asynchronous_event_notification
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x10
push 0x29
push 0x400
push edi
push dword [0x4b6d9c]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
je 0x41237a
push str.Binding
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x10
push 0x10
push 0x4bf3c0
push dword [0x4b6d9c]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x41237a
push str.Listening
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x10
push 0xa
push dword [0x4b6d9c]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4123a1
call fcn.0040182a
push str.Closing_socket
push 0x495ff1
push 0
push 3
call fcn.004017f8
add esp, 0x10
push dword [0x4b6d9c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
Function at 0x414ba0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
xor esi, esi
push esi
push esi
call fcn.0040128a
add esp, 8
push eax
lea eax, [ebp - 0x68]
push str._s_s
push eax
call fcn.0041bff0
lea eax, [ebp - 0x68]
push eax
call fcn.00401334
push 0x64
lea eax, [ebp - 0x68]
push str..dat
push eax
call fcn.004014ba
add esp, 0x20
lea eax, [ebp - 0x68]
push esi
push 0x80
push 4
push esi
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x414cb6
push esi
lea eax, [ebp - 0xd0]
push eax
push 0x64
lea eax, [ebp - 0xcc]
push eax
push ebx
mov dword [ebp - 0xd0], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x64
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.00401b68
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x20
push eax
call fcn.004014b5
add esp, 4
push eax
call fcn.0041c2a0
add esp, 8
push dword [ebp + 0x10]
test eax, eax
je 0x414c81
push eax
call fcn.004014b5
add esp, 4
push eax
push edi
call fcn.004014ec
mov esi, 1
jmp 0x414c8c
push 0x495ff1
push edi
call fcn.004014ec
add esp, 0xc
or eax, 0xffffffff
cmp dword [ebp - 0xd0], 0
push ebx
cmovle esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
Function at 0x416f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4b6e40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0xfe
lea eax, [ebp - 0x103]
push 0
push eax
mov byte [ebp - 0x104], 0
call fcn.0041c510
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0xffff
push esi
push edi
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x108], 0xff
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x417002
push dword [ebp + 0x14]
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.004014ec
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0041c3d0
mov esp, ebp
pop ebp
ret
Function at 0x43c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43c98d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43c994
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43c9ab
mov ecx, dword [ebp - 4]
push ecx
call fcn.004240f0
add esp, 4
or eax, 0xffffffff
jmp 0x43c9ad
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x451b70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 4
imul eax, eax, 0x17
mov ecx, dword [eax + 0x4c67c0]
xor ecx, dword [0x4b6e40]
mov dword [ebp - 4], ecx
je 0x451ba2
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
jmp 0x451bc1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00451a30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1002ff00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010fe01
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1013b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov dword [ecx + 0x3440], 0
mov dword [ecx + 0x3444], 0
mov dword [ecx + 0x3448], 0
mov byte [ecx + 0x3459], 0
mov byte [ecx + 0x3464], 0
mov byte [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov dword [ecx + 0x3760], 0
mov dword [ecx + 0x3764], 0
mov dword [ecx + 0x3768], 0
mov byte [ecx + 0x3770], 0
mov dword [ecx + 0x3780], 0
mov byte [ecx + 0x3786], 0
mov dword [ecx + 0x3788], 0
mov dword [ecx + 0x378c], 0
call fcn.10026600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100304d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1003052e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.10029480
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x10030500
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x10030545
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x10030545
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x10030590
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.10029480
test al, al
je 0x10030581
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10030550
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1013b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10036e4c
cmp byte [esi + 0x3d], 0
je 0x10036e4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10036e3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10036e01
sub eax, 1
je 0x10036e05
sub eax, 2
jne 0x10036e3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d3ac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036e23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10036e3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d3ac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010d3ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1010d3ac
mov esp, ebp
pop ebp
ret

Function at 0x100398c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101103e4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1013b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x1c
call fcn.1010d3c8
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push esi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.1002d920
mov dword [edi + 0x18], 0x10039780
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
push 0
push edi
push 0x1003e320
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10039988
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.1003e220
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call fcn.10038c70
cmp dword [ebp - 0x1c], 0
je 0x10039966
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010d3ac
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1003a5f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1014e9bc], 0
push ebx
push esi
push edi
je 0x1003a77e
mov ecx, dword [0x1021fde4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003a77e
mov ecx, dword [0x1021fe74]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003a77e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1003a650
xor edx, edx
test ecx, ecx
je 0x1003a679
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003a660
cmp edi, 0x5ff56dc5
je 0x1003a688
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003a77e
mov ecx, dword [ebp - 4]
jmp 0x1003a634
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003a77e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003a77e
movss xmm1, dword [0x1012f130]
xor ebx, ebx
cmp edx, 4
jl 0x1003a74b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003a6ec
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003a707
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003a722
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003a735
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1003a6d1
cmp ebx, edx
jl 0x1003a74f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003a77e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003a773
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1003a760
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret