joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10032fea
mov eax, dword [0x10071684]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10032fdd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003301b
mov eax, dword [0x10071684]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1003300e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003304c
mov eax, dword [0x10071684]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003303f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033099
mov eax, dword [0x10071684]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1003308c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100330ca
mov eax, dword [0x10071684]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100330bd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100330fb
mov eax, dword [0x10071684]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100330ee
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10035a30
Function at 0x10053770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10053797
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10053e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100545f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x10054601
pop esi
ret
push ebx
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x10]
lea ebx, [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x10054639
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
jne 0x10054645
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
xor eax, eax
pop esi
ret
cmp dword [esi + 0x14], 8
jb 0x1005464d
mov esi, dword [esi]
mov eax, dword [ebx]
push esi
inc eax
push eax
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov eax, 1
pop esi
ret
Function at 0x401544
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e800]
jne 0x40154e
repz ret
jmp fcn.00401ba4

Function at 0x4081f5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00404c4d
xor ebx, ebx
cmp dword [0x4301f0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4082ca
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x408235
xor eax, eax
jmp 0x40838e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40822e
push eax
call fcn.00404bea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4301f0], eax
call esi
push eax
call fcn.00404bea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4301f4], eax
call esi
push eax
call fcn.00404bea
mov dword [0x4301f8], eax
lea eax, [ebp - 8]
push eax
call fcn.00404199
test eax, eax
pop ecx
pop ecx
je 0x408298
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004028cd
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4082ca
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404bea
cmp eax, ebx
pop ecx
mov dword [0x430200], eax
je 0x4082ca
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404bea
pop ecx
mov dword [0x4301fc], eax
mov eax, dword [0x4301fc]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x408343
cmp dword [0x430200], esi
je 0x408343
push eax
call fcn.00404c56
pop ecx
call eax
cmp eax, ebx
je 0x408310
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x430200]
call fcn.00404c56
pop ecx
call eax
test eax, eax
je 0x408310
test byte [ebp - 0x18], 1
jne 0x408343
lea eax, [ebp - 0xc]
push eax
call fcn.004041d0
test eax, eax
pop ecx
je 0x40832b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004028cd
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40833a
or dword [ebp + 0x10], 0x200000
jmp 0x408374
or dword [ebp + 0x10], 0x40000
jmp 0x408374
mov eax, dword [0x4301f4]
cmp eax, esi
je 0x408374
push eax
call fcn.00404c56
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x408374
mov eax, dword [0x4301f8]
cmp eax, esi
je 0x408374
push dword [ebp - 4]
push eax
call fcn.00404c56
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4301f0]
call fcn.00404c56
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2d86a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x21d015
lea edi, [esi - 0x1c015]
push edi
jmp 0x2d86ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x2d86c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2d86b0
mov eax, 1
add ebx, ebx
jne 0x2d86d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x2d86e4
jne 0x2d8703
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2d8703
dec eax
add ebx, ebx
jne 0x2d86f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x2d86c8
add ebx, ebx
jne 0x2d86ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x2d8755
xor ecx, ecx
sub eax, 3
jb 0x2d871b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x2d878a
sar eax, 1
mov ebp, eax
jmp 0x2d8726
add ebx, ebx
jne 0x2d8726
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2d86f4
inc ecx
add ebx, ebx
jne 0x2d8734
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2d86f4
add ebx, ebx
jne 0x2d8741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x2d8736
jne 0x2d8752
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x2d8736
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x2d8774
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x2d8766
jmp 0x2d86b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x2d8774
add edi, ecx
jmp 0x2d86b6
pop esi
mov edi, esi
mov ecx, 0x565
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x2d8792
cmp byte [edi], 0
jne 0x2d8792
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x2d8797
lea edi, [esi + 0xd6000]
mov eax, dword [edi]
or eax, eax
je 0x2d8806
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdf400]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdf48c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x2d87c4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdf490]
or eax, eax
je 0x2d8800
mov dword [ebx], eax
add ebx, 4
jmp 0x2d87e1
call dword [esi + 0xdf4a0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x2d8837
cmp al, 0xef
ja 0x2d882a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x2d880c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x2d8819
mov ebp, dword [esi + 0xdf494]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x2d886b
sub esp, 0xffffff80
jmp 0x203a70
Function at 0x10002bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x468
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
xorps xmm0, xmm0
mov byte [ebp - 0x470], 0
mov dword [ebp - 0x46c], 6
mov dword [ebp - 0x468], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [esi + 0x10]
xor ecx, ecx
inc eax
mov dword [ebp - 4], 0
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001d7ed
add esp, 4
mov ecx, eax
cmp dword [esi + 0x14], 7
mov dword [ebp - 0x20], ecx
jbe 0x10002c62
mov esi, dword [esi]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10002c62
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x474]
push eax
push 0x460
lea eax, [ebp - 0x470]
mov dword [ebp - 0x14], ecx
push eax
push dword [0x100353a4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d7f6
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100031e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10002af0

Function at 0x10003210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10002cc0

Function at 0x10003220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10002d80

Function at 0x10003230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10002e40

Function at 0x100032a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10002f70
Function at 0x100032b0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026b30
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc48
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc2c], ecx
mov eax, dword [ebx + 0xc]
lea edi, [ebp - 0xc28]
mov esi, dword [ebx + 8]
mov ecx, 0x182
rep movsd dword es:[edi], dword [esi]
xor edx, edx
lea esi, [ebp - 0xc28]
movups xmm0, xmmword [eax]
mov ecx, 0x182
lea edi, [ebp - 0x61c]
rep movsd dword es:[edi], dword [esi]
movups xmmword [ebp - 0xc58], xmm0
movups xmmword [ebp - 0xc48], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc38], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], dx
lea eax, [ebp - 0x410]
mov dword [ebp - 4], edx
push eax
lea eax, [ebp - 0xa10]
mov dword [ebp - 0x628], edx
push 0x1f4
push eax
call fcn.1001ecd0
mov eax, dword [ebp - 0xc38]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001d7ed
mov esi, dword [ebp - 0xc58]
lea ecx, [ebp - 0xc48]
add esp, 0x10
mov edx, eax
cmp dword [ebp - 0xc34], 7
mov dword [ebp - 0x628], edx
cmova ecx, esi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x100033b0
mov edi, dword [ebp - 0xc2c]
push 0
push 0
push 0x3ec
mov eax, dword [edi + 4]
inc dword [eax]
lea eax, [ebp - 0xa10]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100033f2
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc34]
cmp eax, 7
jbe 0x10003428
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x1000341e
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003448
push ecx
push esi
call fcn.1001d7df
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001d7f6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.1001eb40
int3

Function at 0x100035e0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 4
call fcn.1001d7af
mov esi, eax
add esp, 4
test esi, esi
je 0x100035fe
mov dword [esi], 0
jmp 0x10003600
xor esi, esi
mov eax, dword [ebp + 0x288]
push 0
push 0
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x284]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov ecx, dword [ebp - 4]
sub esp, 0x28
mov eax, esp
sub esp, 0x278
mov edi, esp
push dword [ebp + 8]
mov dword [eax + 4], esi
lea esi, [ebp + 0xc]
mov dword [eax + 8], ecx
mov ecx, 0x9e
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_d5100133af80b12a3e3dd44c7bcb0575___void__struct_HookParam__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov dword [eax + 0x24], eax
rep movsd dword es:[edi], dword [esi]
call fcn.100147a0
add esp, 0x2a4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003770
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0x100353a4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
sub esp, 0x28
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_c2ef93eccb59abfad8aae9687a608b10___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____struct_ThreadParam__.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_497b18fe317f7d4c8395f5d607e8cf4e___void__unsigned_long_long_unsigned___int64___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_477f48146a8e4ba93f4a44024a2ab751___void__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_80cf92de41470ca1e458c6e6fcf8331c___bool__class_TextThread___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_749db9615ff5af5479f91f9be945bff5___void__class_TextThread__.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_504a63602a52f752bfc55c1819df4492___void__class_TextThread__.0
mov dword [eax + 0x24], eax
mov eax, esp
sub esp, 0x28
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_45c0fe9e88262ad828d8e6e2ab17fb1e___void__unsigned_long_int_.0
mov dword [eax + 0x24], eax
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_9e5f018547949660351f28be45fd5ed1___void__unsigned_long_int_.0
mov dword [eax + 0x24], eax
call fcn.10017090
add esp, 0x140
mov esp, ebp
pop ebp
ret
Function at 0x100038b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x3f4], eax
call fcn.100149d0
add esp, 4
test eax, eax
je 0x1000398c
push esi
add eax, 0x158
push 0x3e8
push eax
call fcn.1001ecd0
mov eax, ebx
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003900
sub eax, edx
mov esi, 0x1505
push edi
sar eax, 1
xor edi, edi
add eax, eax
je 0x1000394c
nop dword [eax + eax]
dec eax
lea ebx, [ebx + 1]
mov dword [ebp - 0x3f0], eax
mov ecx, edi
mov eax, esi
shld edi, esi, 5
shl esi, 5
add esi, eax
movzx eax, byte [ebx - 1]
cdq
adc edi, ecx
add esi, eax
mov eax, dword [ebp - 0x3f0]
adc edi, edx
test eax, eax
jne 0x10003920
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10003fb0
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d7f6
mov esp, ebp
pop ebp
ret
Function at 0x10006d80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10026d93
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10034100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x10006e7a
test dl, 0x10
jne 0x10006e7a
mov al, 1
jmp 0x10006e7c
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x10006ea0
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x10006ed3
jbe 0x10006ed3
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x10006eb8
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.10005f70
jmp 0x10006ed3
sub esi, edx
je 0x10006ed0
shl esi, 3
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10010dc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027675
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10034100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10010830
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10010e53
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x3333333
je 0x10010fb3
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1001d7af
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.100116c0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1002d1e0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1002d1e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10010f55
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001dc70
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10010f37
cmp ebx, 0x200
jae 0x10010f35
shl ebx, 3
cmp ebx, ecx
jae 0x10010f37
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10018020
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10010830
mov edx, dword [eax]
jmp 0x10010f58
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10010f83
mov dword [ecx + eax*8], esi
jmp 0x10010f92
cmp edi, edx
jne 0x10010f8c
mov dword [ecx + eax*8], esi
jmp 0x10010f96
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10010f96
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.1001bd55
int3