joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023143
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1002f6fc]
push esi
xor esi, esi
jmp 0x10023155
cmp dword [edx + 4], esi
jne 0x100231a9
mov edx, dword [edx]
test edx, edx
jne 0x1002314e
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x100231a5
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1002317c
mov eax, dword [0x1002f6fc]
mov dword [edx], eax
mov dword [0x1002f6fc], edx
pop edi
test edx, edx
jne 0x100231a9
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x10023a53
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x20
mov eax, dword [0x1002f040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x10023b60
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x1c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10023b59
inc edi
push ebx
cmp dword [esp + 0x10], 0x10
jb 0x10023b1a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x1c], eax
jne 0x10023b1a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x18], eax
je 0x10023b1a
mov edx, dword [esi]
test edx, edx
jne 0x10023ae5
push 0x200
push edx
push dword [0x1002f634]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10023b41
lea ebx, [esi + 8]
jmp 0x10023b0f
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x10023b0f
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x1002f634]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10023b41
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10023a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10023b58
xor edi, edi
cmp dword [esi], edi
je 0x10023b58
push dword [esi]
push edi
push dword [0x1002f634]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x28]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1002515c
add esp, 0x20
ret
Function at 0x10023b74
Capabilities:
Suspend thread

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov dword [esp + 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.10023a53
test eax, eax
jne 0x10023b95
push 9
pop esi
jmp 0x10023bdc
cmp dword [edi], esi
je 0x10023bdc
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x10023bdb
push ebp
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebp, eax
test ebp, ebp
je 0x10023bd4
push ebp
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, ebp
call fcn.10023902
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x10023ba2
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x10023be2
Capabilities:
Resume thread

Disassembly:
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi], ebp
je 0x10023c2e
push edi
mov edi, ebp
cmp dword [esi + 8], ebp
jbe 0x10023c1e
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push ebp
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10023c17
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10023bf5
pop ebx
push dword [esi]
push ebp
push dword [0x1002f634]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
ret
Function at 0x10023c31
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
mov eax, dword [0x1002f040]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
imul ebp, ecx, 0x2c
push esi
push edi
mov esi, edx
mov dword [esp + 0x14], esi
add ebp, dword [0x1002f6f0]
mov eax, dword [ebp]
mov cl, byte [ebp + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea edi, [eax*2 + 5]
lea eax, [esp + 0x18]
mov dword [esp + 0x10], edi
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10023c8a
push 0xa
pop eax
jmp 0x10023d0c
test esi, esi
je 0x10023cac
mov byte [ebx], 0xe9
mov eax, dword [ebp + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [ebp + 0x14], 1
je 0x10023ccc
mov eax, dword [ebp]
mov word [eax], 0xf9eb
jmp 0x10023ccc
test byte [ebp + 0x14], 1
je 0x10023cc1
mov edi, ebx
lea esi, [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
jmp 0x10023ccc
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
mov al, byte [ebp + 0x10]
mov byte [ebx + 4], al
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp + 0x14]
mov cl, dl
add cl, cl
shl dl, 2
xor cl, byte [ebp + 0x14]
and cl, 2
xor cl, byte [ebp + 0x14]
xor dl, cl
and dl, 4
xor dl, cl
xor eax, eax
mov byte [ebp + 0x14], dl
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002515c
add esp, 0x10
ret

Function at 0x100243c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10024401
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov dword [0x1002f6b0], 3
push eax
push eax
push dword [ebp + 8]
push 0x1002441e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10024417
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10024417
cmp dword [ebp + 0xc], 0
jne 0x10024417
cmp dword [ebp + 0x10], 0
jne 0x10024417
call fcn.10024d21
call fcn.10023e2e
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x10024f9d
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002f040]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push edi
push str.darksiders1.exe
mov bl, cl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x14], 0x86110ff3
mov dword [esp + 0x18], 0x100
mov dword [esp + 0xc], 0x86110ff3
lea edi, [eax + 0x553eb5]
mov dword [esp + 0x10], 0x100
lea ebp, [eax + 0x86337a]
lea eax, [esp + 0x1c]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x1c]
push eax
push 0x40
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
je 0x1002501d
mov eax, 0x90909090
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x10025038
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1002515c
add esp, 0x18
ret
Function at 0x411beb
Capabilities:
Encode data using xor

Disassembly:
wait
stosb byte es:[edi], al
insd dword es:[edi], dx
mov ss, esp
lahf
pop ds
int1
iretd
les edi, [ebx + 0x56088daa]
jae 0x411acd
movsd dword es:[edi], dword [esi]
xchg ebp, eax
enter 0xffffffffffffc058, 0xffffffffffffffbc
inc esi
retf
mov cl, 0xaa
cmp al, 0xb3
scasd eax, dword es:[edi]
cmp dword [eax], edi
pop esi
daa
sbb bh, bh
jns 0x411aee
sub esp, dword [ecx + 0x18d1cd25]
mov eax, 0x727f2037
invalid
enter 0x5b79, 0xfffffffffffffff7
ljmp 0x1de5
pop ds
in eax, 0x1d
in eax, 0x1d
je 0x411b61
mov dword [ecx - 0x6314813c], esp
fcomp qword [edx + ebx*8 + 0x10]
sub byte [esi + esi + 0x61a4c2df], al
outsd dx, dword [esi]
push esp
loope 0x411b3d
mov eax, dword [0x3cbd777d]
mov eax, dword [0x3f864a8e]
ja 0x411b20
cmp al, 0x8b
add eax, 0x3f864a8e
sbb byte [edi - 0x5f], al
pop ss
xor dword [edx + 0x3e], edi
jle 0x411b6d
pop esp
and al, 0x1c
push eax
pushfd
aaa
adc ecx, edi
xchg edi, eax
aad 0xc6
mov eax, dword [0x45b69189]
enter 0x4966, 0xffffffffffffff94
and byte [eax - 0x42], dl
arpl word [edx], cx
invalid
nop
leave
pop eax
nop
pop edx
mov ebx, 0x53bcf4d6
insb byte es:[edi], dx
popal
invalid
jb 0x411c1b
stosb byte es:[edi], al
jb 0x411b46
or dl, bh
fmul qword [edi + 0x5529f490]
jg 0x411b65
pushal
js 0x411ba5
invalid
scasd eax, dword es:[edi]
test eax, 0xe144ac00
popal
cmp eax, 0xd0c90bcf
dec ecx
dec eax
and dh, byte [ebp + ebx*4 - 0x1b]
inc eax
in al, 0xec
push ecx
pop es
ret
mov fs, word [ebx]
jae 0x411bfb
dec esp
popal
or byte [eax + 0x14], 0x2c
je 0x411c45
imul ebx, dword [eax - 0x3fabcca4], 0xed5a7a6
test dword [ecx + 0x29], esp
jmp 0x411bb6
push esp
shl byte [esi - 0x7af12a59], 0x61
sub ebx, ebp
mov al, 0x9e
inc ecx
std
jecxz 0x411bb0
mov esp, 0x3d543367
loopne 0x411bcc
sar byte [esi], 1
salc
or edx, esp
adc dword [eax - 0x41], esp
cmp byte [esi - 0x6f], bl
pushal
mov edi, 0xba915e38
cli
cmp eax, 0x28269643
movsb byte es:[edi], byte [esi]
pushfd
xchg ebx, eax
pop esi
xchg ecx, eax
mov edx, 0x96433dfa
sub byte es:[esp + ebx*4 + 0x1b309364], ah
xchg ebx, eax
xor byte [ebx], bl
xchg esi, eax
xchg esp, eax
xor eax, 0x789f3ffd
push ds
loop 0x411c77
and byte [edx - 0x47], bl
xchg esp, eax
pop esp
pushal
xchg esi, eax
fst qword [edx - 0x3e0c00ca]
insb byte es:[edi], dx
add al, dl
jns 0x411c27
adc bh, byte [edi + 0x6a]
mov esi, 0x63140996
xchg edx, eax
sbb dword [ecx], edx
cmp eax, dword [esi + ebp*4]
mov edi, 0x51e9e8f4
fucomi st(5)
ficomp dword [edx]
salc
sub byte [ecx - 0xadc1b0], 0x9c
push eax
adc byte [ebx + 0x185b3810], cl
mov al, byte [0x4094759a]
sub eax, 0x7e811c2e
dec ebx
xchg edi, eax
cdq
and byte [esi], bh
cmp dword [esi + 0x4b], 0x3e209997
push cs
out 0x61, eax
aad 0x96
pop esi
fsubr dword [esi + 0x5e]
jne 0x411c18
cmp al, 0x51
outsd dx, dword [esi]
mov byte [0x5e3a3abe], cl
invalid
Function at 0x453b59
Capabilities:
Encode data using xor

Disassembly:
jge 0x453a53
cmp ah, byte [ebp + 0x62]
fiadd dword [ebp + 0x12]
xor byte [ebp + 0x4366ee34], bl
sahf
push ds
adc ecx, esp
push ebx
movsd dword es:[edi], dword [esi]
lodsb al, byte [esi]
retf
pcmpgtd mm4, qword [ecx + ebx*4]
cdq
in eax, dx
mov ebp, 0x49653c9f
ja 0x453a56
jecxz 0x453ac2
and cl, bh
sub cl, bh
rol dword [0x9738d925], cl
and eax, 0x12239a0c
sub esi, edx
adc edi, esp
sar ch, 1
or dword [edx - 0x4e], ecx
iretd
dec edx
mov dl, 0xcf
arpl word [ecx], ax
or al, 0x91
test dword [ebx - 0x3dbc5655], ecx
xor al, 0xc7
loope 0x453a08
push esp
mov ah, 0xb6
cmpsd dword [esi], dword es:[edi]
push eax
pushal
add dh, al
xchg ah, dh
mov cl, 0x3c
jno 0x453b0d
mov ebx, 0x84f79f2
shl al, 1
sbb al, 0x3e
push ebx
inc ebx
xor byte [edi - 0xc], dh
pop ebp
in eax, dx
sahf
int3
jno 0x453acb
out dx, eax
aam 0xb1
pop edx
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
add ah, ch
pmulhuw mm4, qword [eax + 0x3e78c709]
push ds
ficomp dword [ebp + eax*4 - 0x66]
sbb eax, 0x883a675
mov eax, dword [0x369c2ee5]
jle 0x453a77
invalid
jno 0x453b58
mov esp, 0x98f1d14f
inc ecx
popal
mov byte [0x94571610], al
in al, dx
stosd dword es:[edi], eax
pop ss
les eax, [ecx]
xchg esi, eax
in eax, 0xb0
loop 0x453af6
dec ebx
idiv dword [ebx]
push 0x3bf2c856
invalid
retf
cmpsb byte [esi], byte es:[edi]
js 0x453abd
mov dh, 0xdc
xor al, 0x70
sub eax, 0xc66711b7
and byte [edx*4 - 0x208656c], ah
cmpsd dword [esi], dword es:[edi]
xor eax, 0x7731923d
ror byte [eax], cl
cdq
clc
push cs
jmp 0x453b53
pop edx
out dx, al
mov al, byte [0xf98eb87f]
fst qword [eax]
add al, 0x76
fcmovu st(0), st(2)
sub dword [ecx - 0x3d], esi
mov edx, 0xe97e44f0
or eax, 0xd3978b87
shl eax, 1
sbb byte [ecx], bl
in eax, dx
sub esi, ebx
mov eax, 0x63245b61
mov eax, 0x63245b61
arpl word [esp + ebx], cx
or al, 0x1c
xchg esp, eax
mov al, byte [0xda873866]
sub dl, ch
pop eax
call 0x6911962
cmpsd dword gs:[esi], dword es:[edi]
xor eax, 0xb582cae2
stc
je 0x453b32
jb 0x453b0a
adc dword [0x1163efed], esp
push ss
invalid

Function at 0x4732e0
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x209d3957
sub eax, 0x79247abb
push esp
cmpsb byte [esi], byte es:[edi]
test eax, 0x24a2811a
dec ecx
sbb al, byte [ecx - 0xdb6db5e]
mov ebx, dword [esi + 0x4f398632]
and dword [edx - 0x740db6dc], 0x3986329e
dec edi
and al, 0x49
mov ebx, dword [esi + 0x4f398632]
xor ah, byte [esi - 0x10bbb54a]
das
out dx, al
fadd st(1)
stosb byte es:[edi], al
jae 0x4732e3
cmp eax, ecx
loope 0x4732c2
pop ebp
mov esi, 0x36a95dab
fdiv qword [esi + ecx*4]
adc eax, 0xdf2079e4
xchg edx, eax
push ebp
push 0x16
frstor dword [ecx + 0x7465d5b9]
outsd dx, dword ds:[esi]
sti
aam 0x81
xor eax, 0x739affe9
inc ebx
jbe 0x4732e4
aad 0x60
xchg esi, eax
js 0x4732e6
in al, 0x1c
shl dword [eax], cl
invalid
Function at 0x496393
Capabilities:
Encode data using xor

Disassembly:
mul ch
jle 0x496407
and al, 0xa9
xor ch, byte [ebp + 0x44]
iretd
clc
jo 0x49642a
imul eax, dword [ebp + 0x67aca55c], 0xe5b5f4cd
xchg ebp, eax
xor al, 0x53
push ebx
add ecx, dword [ebp + edx + 0x58]
aam 0x4d
pop edx
mov esi, cs
mov word [edi + 0x61], es
add edx, edi
cmp esi, dword [edi - 0x21467884]
xor eax, 0xcc0d2139
fidiv word [0xcc0d2139]
jl 0x496416
scasb al, byte es:[edi]
inc ebp
push 0xfa6618f9
cmp al, 0xfa
and dword [esi + 0x42], ebp
push cs
xchg edi, eax
sub al, 0xd1
sbb al, 0x23
mov esi, 0x6c9700fe
out dx, al
sbb ebp, edx
xchg edx, eax
sbb byte [ebp - 0x74], cl
mov al, 0xe2
or edx, 0xffffff9f
mov dl, 0x94
dec esp
xchg edi, eax
jmp 0x4964ce
push ebp
leave
nop
or esp, esp
sbb dword [ebx - 0x350e368], edx
pop ss
retf 0x64d5

Function at 0x4b934e
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov dl, ah
mov dword [0x4c6d80], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c6d7c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c6d78], ecx
shr eax, 0x10
mov dword [0x4c6d74], eax
push 1
call fcn.004ba437
pop ecx
test eax, eax
jne 0x4b938b
push 0x1c
call fcn.004b944d
pop ecx
call fcn.004ba1f4
test eax, eax
jne 0x4b939c
push 0x10
call fcn.004b944d
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004ba038
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c7434], eax
call fcn.004b9f06
mov dword [0x4c6d64], eax
call fcn.004b9cb9
call fcn.004b9c00
call fcn.004b9910
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b9ba8
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b93eb
movzx eax, word [ebp - 0x2c]
jmp 0x4b93ee
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b993d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9a30
pop ecx
pop ecx
ret

Function at 0x4b999e
Capabilities:
Terminate process

Disassembly:
test eax, eax
je 0x4b99c4
mov ecx, dword [0x4c742c]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b99c3
mov eax, dword [esi]
test eax, eax
je 0x4b99b8
call eax
sub esi, 4
cmp esi, dword [0x4c7430]
jae 0x4b99b0
pop esi
push 0x4c2018
push 0x4c2014
call fcn.004b9a16
pop ecx
pop ecx
push 0x4c2020
push 0x4c201c
call fcn.004b9a16
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b99f2
call fcn.004b9a0d
pop edi
ret
push dword [esp + 8]
mov dword [0x4c6db0], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4ba4cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23e8
cmp edx, dword [eax]
je 0x4ba4ef
add eax, 8
inc ecx
cmp eax, 0x4c2478
jl 0x4ba4e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23e8]
jne 0x4ba61d
mov eax, dword [0x4c6d6c]
cmp eax, 1
je 0x4ba5f7
test eax, eax
jne 0x4ba520
cmp dword [0x4c2314], 1
je 0x4ba5f7
cmp edx, 0xfc
je 0x4ba61d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba557
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baeb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb340
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba59a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb340
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf93c
push edi
call fcn.004bd210
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baeb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baec0
lea eax, [ebp - 0xa0]
push 0x4bf91c
push eax
call fcn.004baec0
push dword [esi + 0x4c23ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baec0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd184
add esp, 0x2c
pop edi
jmp 0x4ba61d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ec]
push 0
push eax
push dword [esi]
call fcn.004bb340
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10010b80
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10048100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov dword [edi + 0x24], 0
mov dword [edi], vtable.std::_Func_impl_no_alloc_class__lambda_0513c60537a004dbf648ea64956d2a4a___void__struct_HookParam_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [edi + 0x24], edi
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 4], 0
call fcn.100198f0
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push str.EMBED_SHARED_MEM
push eax
call fcn.1000f610
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x10010bfb
mov eax, dword [eax]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x10010c47
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010c3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010d49
push ecx
push edx
call fcn.1001cfb0
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x10010c99
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010c8f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010d49
push ecx
push edx
call fcn.1001cfb0
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x2c], 7
call fcn.100198f0
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 4
mov edx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push edx
call fcn.1000f610
add esp, 0xc
lea ecx, [edi + 0x34]
call fcn.10010d60
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x10010d12
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10010d08
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010d4e
push ecx
push edx
call fcn.1001cfb0
add esp, 8
push 0xa00
push 0
push 0
push 6
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d2d8
mov esp, ebp
pop ebp
ret 8
call fcn.10021fdf
call fcn.10021fdf
int3
Function at 0x100139d0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038f01
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x10048100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1004a398
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b0], 0x1004a398
mov byte [ebp - 0x2ac], 0
call fcn.1001b9bb
add esp, 4
test eax, eax
jne 0x10013bce
cmp dword [0x1004a3c4], 0x7fffffff
je 0x10013bd5
mov byte [ebp - 0x2ac], 1
mov dword [ebp - 0x2a8], 0x1004a378
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
mov byte [ebp - 4], 1
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x1004a378
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.1000fe00
mov eax, dword [eax + 4]
test eax, eax
je 0x10013b88
cmp eax, dword [0x1004a37c]
je 0x10013b88
cmp dword [ebp + 0x2a8], 0
je 0x10013ad4
lea eax, [ebp + 0x284]
mov ecx, 0x1004a378
push eax
lea eax, [ebp + 8]
push eax
call fcn.100180d0
mov ecx, eax
call fcn.100116c0
lea eax, [ebp + 8]
mov ecx, 0x1004a378
push eax
call fcn.100180d0
mov dword [ebp - 0x530], 2
lea esi, [ebp + 0xc]
mov ecx, 0x9e
mov dword [ebp - 0x298], eax
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa0
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push 0x288
call fcn.1001cf80
add esp, 4
test eax, eax
je 0x10013b37
mov ecx, 0xa2
lea esi, [ebp - 0x298]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x10013b39
xor eax, eax
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x10010030
push 0
push 0
call fcn.10026dc7
add esp, 0x18
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x10013bed
mov ecx, dword [ebp - 0x29c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x10013be6
push ecx
push eax
call fcn.1001cb97
add esp, 8
test eax, eax
jne 0x10013be6
push 0x1004a398
call fcn.1001b9cc
mov ecx, dword [ebp + 0x2a8]
add esp, 4
test ecx, ecx
je 0x10013bb3
mov edx, dword [ecx]
lea eax, [ebp + 0x284]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d2d8
mov esp, ebp
pop ebp
ret
push 5
call fcn.1001bfa9
push 6
mov dword [0x1004a3c4], 0x7ffffffe
call fcn.1001bfa9
push 1
call fcn.1001bfa9
push 6
mov dword [ebp - 0x29c], 0
call fcn.1001bfa9
int3