joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008ebd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5a85
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1011e00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1008eb60
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1008ec63
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x1008ec77
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.100f25a3
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101180c0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101180c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1008ed61
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100f3600
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1008ed43
cmp ebx, 0x200
jae 0x1008ed41
shl ebx, 3
cmp ebx, ecx
jae 0x1008ed43
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1008f120
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1008eb60
mov edx, dword [eax]
jmp 0x1008ed64
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1008ed8f
mov dword [ecx + eax*8], esi
jmp 0x1008ed9e
cmp edi, edx
jne 0x1008ed98
mov dword [ecx + eax*8], esi
jmp 0x1008eda2
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1008eda2
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1008f120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x1008f151
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1001b0d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1008f25c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1008f1e2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1008f24f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1008f21c
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1008f214
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1008f24f
cmp ebx, edx
je 0x1008f22c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1008f265
cmp ebx, edx
jne 0x1008f220
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x1008f190
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1008f24f
Function at 0x1008f290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1008f2bc
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x10120cd4]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10120cdc
lea eax, [edi + edi]
push eax
call fcn.1001b0d0
mov eax, dword [0x10120cd4]
lea ebx, [edi - 1]
mov dword [0x10120ce8], ebx
mov dword [0x10120cec], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1008f3f6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x10120cdc]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1008f354
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1008f3c1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1008f38e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1008f386
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1008f3c1
cmp ebx, edx
je 0x1008f39e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1008f3d2
cmp ebx, edx
jne 0x1008f392
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1008f3f6
mov ebx, dword [0x10120ce8]
jmp 0x1008f302
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1008f3c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009bbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov ebx, edx
xor edi, edi
push ecx
mov dword [ebp - 0x54], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x1009bc4a
movaps xmm0, xmmword [0x10118330]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xf
jb 0x1009bc28
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xc], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
jne 0x1009bc66
call fcn.1009bb90
mov byte [ebp - 0x1e], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 5]
mov eax, dword [eax + ecx + 0xf]
mov esi, dword [eax]
test esi, esi
je 0x1009bcbf
push ebx
push dword [esi + 4]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x1009bcb8
mov eax, dword [esi + 4]
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009bc90
sub eax, edx
mov edx, ebx
lea ebx, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1009bca0
sub edx, ebx
add eax, 0xfffffffd
cmp eax, edx
jne 0x1009bcb5
test edi, edi
je 0x1009bcdb
dec edi
mov ebx, dword [ebp - 0x54]
mov esi, dword [esi + 8]
test esi, esi
jne 0x1009bc73
call fcn.1009bb90
mov byte [ebp - 0x21], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
call eax
mov esi, eax
call fcn.1009bb90
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
mov byte [ebp - 0x20], 0
pop ebx
call fcn.100f238c
mov esp, ebp
pop ebp
ret
Function at 0x1009bd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov ebx, edx
mov edi, 1
push ecx
mov dword [ebp - 0x54], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x1009bd62
movaps xmm0, xmmword [0x10118330]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 0xc], 0
nop dword [eax + eax]
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0xf
jb 0x1009bd40
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xc], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
jne 0x1009bd7e
call fcn.1009bb90
mov byte [ebp - 0x1e], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 5]
mov eax, dword [eax + ecx + 0xf]
mov esi, dword [eax]
test esi, esi
je 0x1009bdd4
nop dword [eax + eax]
push ebx
push dword [esi + 4]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x1009bdcd
mov eax, dword [esi + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009bda7
sub eax, edx
mov edx, ebx
lea ebx, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x1009bdb5
sub edx, ebx
add eax, 0xfffffffd
cmp eax, edx
jne 0x1009bdca
test edi, edi
je 0x1009bdf0
dec edi
mov ebx, dword [ebp - 0x54]
mov esi, dword [esi + 8]
test esi, esi
jne 0x1009bd90
call fcn.1009bb90
mov byte [ebp - 0x21], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
call eax
mov esi, eax
call fcn.1009bb90
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
mov byte [ebp - 0x20], 0
pop ebx
call fcn.100f238c
mov esp, ebp
pop ebp
ret
Function at 0x1009be20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5b1d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1011e00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x101202c4]
mov esi, dword [eax + edx*4]
mov eax, dword [0x10120d04]
cmp eax, dword [esi + 4]
jle 0x1009bee2
push 0x10120d04
call fcn.100f24cd
add esp, 4
cmp dword [0x10120d04], 0xffffffff
jne 0x1009bee2
mov dword [ebp - 4], 0
xor ecx, ecx
movaps xmm0, xmmword [0x10117400]
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x10117260]
movups xmmword [ebp - 0x24], xmm0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x1e
jb 0x1009bea0
push str.client.dll
mov byte [ebp - 0x15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea edx, [ebp - 0x33]
mov ecx, eax
call fcn.1006a9d0
push 0x10120d04
mov eax, dword [eax + 1]
mov dword [0x10120d00], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f2483
add esp, 4
mov eax, dword [0x10120cfc]
cmp eax, dword [esi + 4]
jle 0x1009bf76
push 0x10120cfc
call fcn.100f24cd
add esp, 4
cmp dword [0x10120cfc], 0xffffffff
jne 0x1009bf76
mov dword [ebp - 4], 1
xor ecx, ecx
movaps xmm0, xmmword [0x10118960]
movups xmmword [ebp - 0x44], xmm0
mov byte [ebp - 0x14], 0
movaps xmm0, xmmword [0x10117640]
movups xmmword [ebp - 0x34], xmm0
movaps xmm0, xmmword [0x10118600]
movups xmmword [ebp - 0x24], xmm0
mov al, byte [ebp - 0x44]
xor byte [ebp + ecx - 0x43], al
inc ecx
cmp ecx, 0x2f
jb 0x1009bf37
push str.client.dll
mov byte [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea edx, [ebp - 0x43]
mov ecx, eax
call fcn.1006a9d0
push 0x10120cfc
mov dword [0x10120cf4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100f2483
add esp, 4
mov ecx, dword [0x10120d00]
push ebx
call dword [0x10120cf4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f238c
mov esp, ebp
pop ebp
ret
Function at 0x100f1bf1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100f1bcd
pop esi
leave
ret 8
Function at 0x1003dee5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1003def4
pop dword [ebp - 0x2c]
mov eax, 0x80a27d61
add eax, 0x8f616193
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x57dfea1
sub dword [ebp - 0x3c], 0xb72bb956
mov dword [ebp - 0x38], 0xcfa07234
sub dword [ebp - 0x38], 0x9d6d25ef
mov dword [ebp - 0x34], 0x3e9886fc
add dword [ebp - 0x34], 0xdb3bd32
mov dword [ebp - 0x30], 0x32eeb5bf
sub dword [ebp - 0x30], 0x32eeb5bf
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x10ec48ef
add eax, 0xff1885f1
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x2f40a0ee
add dword [ebp - 0x3c], 0x4531c868
mov dword [ebp - 0x38], 0x5e4747ec
add dword [ebp - 0x38], 0xe3251989
mov dword [ebp - 0x34], 0xc144eb70
sub dword [ebp - 0x34], 0x5dd57f04
mov dword [ebp - 0x30], 0xfa0b1df1
add dword [ebp - 0x30], 0x5f4e20f
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x5c737c5c
add eax, 0xb3915228
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3d1dc
push 0
call eax
mov ecx, 0x3d85
mov edx, eax
mov esi, 0x1005b400
add esi, dword [ebp - 0x2c]
mov ebx, 0x298533db
sub ebx, 0xf83bf210
sub dword [ebp - 0x1c], 0x2b75d9d8
mov edi, dword [esi]
xor dword [ebp - 0x20], ecx
xor edi, ebx
add dword [ebp - 0x14], 0x5716774e
mov dword [edx], edi
add edx, 4
add esi, 0xc3480da4
add esi, 0x3cb7f260
loop 0x1003e00a
add eax, 0x89f4115f
sub eax, 0x89f32878
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x407539
Capabilities:
Check os version
Terminate process

Disassembly:
and esi, 0xffffffff
neg ecx
mov dword [0x410edb], esi
and edi, 0xffffffff
not ecx
mov dword [0x410ed7], edi
and ebx, 0xffffffff
not ecx
mov dword [0x410ee7], ebx
pop eax
jmp fcn.00403f7c

Function at 0x10001016
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
push esi
push edi
push 0x10003010
push 0x65
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10001061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001061
push edi
push dword [0x1000313c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x10001065
xor eax, eax
jmp 0x100010a7
push ebx
mov ebx, dword [esi]
push 0
push 4
push 2
push 0
push 2
push 0x40000000
push 0x10003038
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010a3
lea eax, [esp + 0xc]
push 0
push eax
add esi, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop ebx
pop edi
pop esi
pop ecx
ret

Function at 0x100010ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
xor edx, edx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push 0x8000000
push edx
push edx
push edx
push 0x10003038
push edx
mov word [ebp - 0x24], dx
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x10001110
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x10]
call esi
pop esi
xor eax, eax
leave
ret
Function at 0x10001000
Capabilities:
Create thread
Print debug messages

Disassembly:
push str.PluginCommand___HookAttach___n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
call fcn.100186c0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call fcn.10018f10
push 0x100011c0
push 0x1008376c
call fcn.10018fd0
cmp byte [0x10083750], 0
je 0x1000109d
push 0x100012f0
push 0x10083770
call fcn.10018fd0
push 0x10001550
push 0x10083774
call fcn.10018fd0
push 0x10001890
push 0x10083778
call fcn.10018fd0
push 0x10001a40
push 0x1008377c
call fcn.10018fd0
push 0x10001c10
push 0x10083780
call fcn.10018fd0
push 0x10001d90
push 0x10083784
call fcn.10018fd0
push 0x10002370
push 0x10083788
call fcn.10018fd0
call fcn.10018920
cmp byte [0x10083750], 0
je 0x100010c5
push 0
push 0
push 0
push 0x100023d0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x10083748], eax
ret

Function at 0x100010d0
Capabilities:
Print debug messages

Disassembly:
push str.PluginCommand___HookDetach___n
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
call fcn.100186c0
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call fcn.10018f10
push 0x100011c0
push 0x1008376c
call fcn.100199f0
cmp byte [0x10083750], 0
je 0x1000116d
push 0x100012f0
push 0x10083770
call fcn.100199f0
push 0x10001550
push 0x10083774
call fcn.100199f0
push 0x10001890
push 0x10083778
call fcn.100199f0
push 0x10001a40
push 0x1008377c
call fcn.100199f0
push 0x10001c10
push 0x10083780
call fcn.100199f0
push 0x10001d90
push 0x10083784
call fcn.100199f0
push 0x10002370
push 0x10083788
call fcn.100199f0
call fcn.10018920
cmp byte [0x10083750], 0
je 0x100011b6
cmp dword [0x10083748], 0
je 0x100011b6
mov eax, dword [0x10083764]
push eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov ecx, dword [0x10083748]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, dword [0x10083748]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x10083748], 0
ret

Function at 0x10005230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x10005247
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
test esi, esi
je 0x10005278
push ebx
push ebp
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10005274
cmp esi, eax
jae 0x10005278
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10005264
cmp esi, eax
jb 0x1000527e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10007d00
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x1006b030
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100810f0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x100829cc]
mov edx, dword [eax + 0xc]
mov ecx, 0x100829cc
call edx
add eax, 0x10
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x1c], 1
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
push eax
push str.0.8.4
push edx
push str._sres_mods_s_s
lea edi, [esp + 0x38]
call fcn.1000bd60
mov esi, dword [esp + 0x38]
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push ebp
mov ecx, str.true
test eax, eax
jne 0x10007d8a
mov ecx, str.false
call fcn.10002620
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x1c], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10007daf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10007dd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc