joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443130
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x44313b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x44323e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x45eda8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45eda8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45eda8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45eda8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45eda8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x45eda8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x45eda8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45eda8]
xor eax, edx
inc ecx
dec edi
jne 0x443156
pop edi
test esi, esi
je 0x443260
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45eda8]
xor eax, edx
inc ecx
dec esi
jne 0x443242
pop esi
pop ebx
not eax
ret

Function at 0x443c00
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x443c41
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x443c36
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x443c54
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x444d70
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x444e28
cmp dword [ebp + 4], 0xffffffff
jne 0x444e28
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x46a674
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x444ded
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x444ded
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.00443990
add esp, 0x10
test eax, eax
jne 0x444e10
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.00443f80
add esp, 4
mov dword [ebp], eax
mov eax, dword [0x46b60c]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x445320
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
je 0x4453e7
mov al, byte [ebx]
test al, al
je 0x4453e7
push esi
push edi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x44534e
cmp al, 0x5c
jne 0x445350
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x445346
mov edi, dword [esp + 0x218]
cmp esi, ebx
je 0x445384
sub esi, ebx
lea eax, [esp + 0xc]
push esi
push ebx
push eax
call sub.MSVCRT.dll__mbsnbcpy
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.00445320
add esp, 0x14
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x455090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov eax, dword [ebx + 8]
mov esi, eax
and esi, 7
je 0x4550c3
cmp eax, esi
jge 0x4550b1
push ebx
call fcn.00454900
add esp, 4
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
mov ecx, esi
shr edx, cl
sub eax, esi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov ecx, dword [ebx + 8]
xor eax, eax
test ecx, ecx
jle 0x4550f2
mov esi, 0xfffffff8
mov edx, ecx
mov cl, byte [ebx + 0xc]
mov ebp, dword [ebx + 0xc]
mov byte [esp + eax + 0xc], cl
add edx, esi
inc eax
shr ebp, 8
test edx, edx
mov dword [ebx + 0xc], ebp
jg 0x4550d3
cmp eax, 4
mov dword [ebx + 8], edx
jge 0x455110
mov esi, dword [ebx + 4]
mov edx, dword [ebx]
cmp edx, esi
jb 0x4550ff
xor ecx, ecx
jmp 0x455106
xor ecx, ecx
mov cl, byte [edx]
inc edx
mov dword [ebx], edx
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 4
jl 0x4550f5
mov ebp, dword [esp + 0xd]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0xf]
mov ecx, dword [esp + 0xe]
and ebp, 0xff
and edx, 0xff
shl ebp, 8
add ebp, edx
and eax, 0xff
shl eax, 8
and ecx, 0xff
mov edx, ebp
add eax, ecx
xor edx, 0xffff
cmp eax, edx
je 0x455161
push str.zlib_corrupt
call fcn.00452390
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
add eax, ebp
cmp eax, ecx
jbe 0x455180
push str.read_past_buffer
call fcn.00452390
add esp, 4
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x18]
mov ecx, ebp
add ecx, edx
cmp ecx, eax
jbe 0x4551a3
push ebp
push ebx
call fcn.00454c90
add esp, 8
test eax, eax
jne 0x4551a3
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [ebx]
mov ecx, ebp
mov edx, ecx
push edi
mov edi, dword [ebx + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
add ecx, ebp
add eax, ebp
pop edi
pop esi
mov dword [ebx], ecx
mov dword [ebx + 0x10], eax
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x401bc5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c04
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c04
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c04
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c04
cmp dword [ecx + 0x74], 0xe
jbe 0x401c04
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4122b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4446f5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x454100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00411ed0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x412343
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x38e38e3
je 0x4124a3
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0041f72c
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.00412c50
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x447270]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x447270]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x412445
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.0042eae0
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0041ff50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x412427
cmp ebx, 0x200
jae 0x412425
shl ebx, 3
cmp ebx, ecx
jae 0x412427
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.004191b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00411ed0
mov edx, dword [eax]
jmp 0x412448
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x412473
mov dword [ecx + eax*8], esi
jmp 0x412482
cmp edi, edx
jne 0x41247c
mov dword [ecx + eax*8], esi
jmp 0x412486
cmp dword [ecx + eax*8 + 4], ebx
jne 0x412486
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.0041cee9
int3
Function at 0x412c50
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444778
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov dword [edi + 0x24], 0
mov dword [edi], vtable.std::_Func_impl_no_alloc_class__lambda_e5cd50f2e477aac0877c77c51419bb99___void__struct_HookParam_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [edi + 0x24], edi
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 4], 0
call fcn.0041af20
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push str.EMBED_SHARED_MEM
push eax
call fcn.004116e0
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x412ccb
mov eax, dword [eax]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x412d17
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e19
push ecx
push edx
call fcn.0041f75c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x412d69
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e19
push ecx
push edx
call fcn.0041f75c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x2c], 7
call fcn.0041af20
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 4
mov edx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push edx
call fcn.004116e0
add esp, 0xc
lea ecx, [edi + 0x34]
call fcn.00412e30
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x412de2
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412dd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e1e
push ecx
push edx
call fcn.0041f75c
add esp, 8
push 0xa00
push 0
push 0
push 6
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret 8
call fcn.0042466f
call fcn.0042466f
int3
Function at 0x415900
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444b21
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4560f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b0], 0x4560f0
mov byte [ebp - 0x2ac], 0
call fcn.0041f1ef
add esp, 4
test eax, eax
jne 0x415afe
cmp dword [0x45611c], 0x7fffffff
je 0x415b05
mov byte [ebp - 0x2ac], 1
mov dword [ebp - 0x2a8], 0x4560d0
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
mov byte [ebp - 4], 1
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4560d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.00411ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x415ab8
cmp eax, dword [0x4560d4]
je 0x415ab8
cmp dword [ebp + 0x2a8], 0
je 0x415a04
lea eax, [ebp + 0x284]
mov ecx, 0x4560d0
push eax
lea eax, [ebp + 8]
push eax
call fcn.00419700
mov ecx, eax
call fcn.00413780
lea eax, [ebp + 8]
mov ecx, 0x4560d0
push eax
call fcn.00419700
mov dword [ebp - 0x530], 2
lea esi, [ebp + 0xc]
mov ecx, 0x9e
mov dword [ebp - 0x298], eax
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa0
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push 0x288
call fcn.0041f72c
add esp, 4
test eax, eax
je 0x415a67
mov ecx, 0xa2
lea esi, [ebp - 0x298]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x415a69
xor eax, eax
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x412230
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x415b1d
mov ecx, dword [ebp - 0x29c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x415b16
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x415b16
push 0x4560f0
call fcn.0041f200
mov ecx, dword [ebp + 0x2a8]
add esp, 4
test ecx, ecx
je 0x415ae3
mov edx, dword [ecx]
lea eax, [ebp + 0x284]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d242
push 6
mov dword [0x45611c], 0x7ffffffe
call fcn.0041d242
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x29c], 0
call fcn.0041d242
int3
Function at 0x416ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444d5c
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
call fcn.00414f90
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x416f96
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041af20
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push ecx
call fcn.004116e0
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00412e30
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 2
test eax, eax
je 0x416f50
cmp eax, 0xffffffff
je 0x416f50
push eax
call dword [0x446a80]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00404af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416fd3
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x10
movups xmmword [ecx], xmm0
push str.already_injected
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b500
call fcn.00414de0
add esp, 0x18
mov ecx, dword [ebp + 0x20]
cmp ecx, 7
jbe 0x417070
mov edx, dword [ebp + 0xc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417066
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41708a
jmp 0x417066
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0040bda0
push 0x1c
mov byte [ebp - 4], 3
call fcn.0041f72c
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x417010
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [esi], ecx
lea ecx, [esi + 4]
push eax
call fcn.0040bda0
jmp 0x417012
xor esi, esi
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
push 0
push esi
push 0x412180
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x34], eax
test eax, eax
je 0x417096
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x41708f
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x41708f
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
movlpd qword [ebp - 0x34], xmm0
call fcn.00412ee0
jmp 0x416f96
push ecx
push edx
call fcn.0041f75c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret
call fcn.0042466f
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x30], 0
call fcn.0041d242
int3
Function at 0x4173e0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x454100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4560f0
mov dword [ebp - 0x2c], 0x4560f0
mov byte [ebp - 0x28], 0
call fcn.0041f1ef
add esp, 4
test eax, eax
jne 0x41754a
cmp dword [0x45611c], 0x7fffffff
je 0x417551
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4560d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4560d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x41752e
cmp eax, dword [0x4560d4]
je 0x41752e
lea eax, [ebp + 8]
mov ecx, 0x4560d0
push eax
call fcn.00419700
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [ebp - 0x20]
push 0x18
mov dword [ebp - 0x44], eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0041f72c
add esp, 4
test eax, eax
je 0x4174ed
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
jmp 0x4174ef
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412100
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x417569
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x417562
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x417562
push 0x4560f0
call fcn.0041f200
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d242
push 6
mov dword [0x45611c], 0x7ffffffe
call fcn.0041d242
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d242
int3
Function at 0x4180f0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x4470c8
push str.kernel32.dll
push ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], 0
call fcn.00415b30
push edx
push eax
push ebx
call fcn.00415e30
mov ecx, dword [0x455f58]
mov dword [ebp - 0x458], eax
or eax, edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x448], ecx
jne 0x41823c
test ebx, ebx
mov eax, ebx
cmove eax, dword [0x455f54]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x418202
push 0x424
lea eax, [ebp - 0x434]
mov dword [ebp - 0x438], 0x428
push 0
push eax
call fcn.004215c0
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4181fb
lea eax, [ebp - 0x418]
push str.kernel32.dll
push eax
call fcn.004247bf
add esp, 8
test eax, eax
je 0x41825f
lea eax, [ebp - 0x438]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x4181d2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movlpd qword [ebp - 0x440], xmm0
mov eax, dword [ebp - 0x440]
mov edx, dword [ebp - 0x43c]
push 0x4470c8
push edx
push eax
push ebx
call fcn.004162c0
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x448], 0
cmp dword [edi + 0x14], 7
mov dword [ebp - 4], 0
jbe 0x41824b
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x460]
call fcn.004117f0
or eax, edx
je 0x41826f
mov bl, 1
jmp 0x418271
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
cdq
jmp 0x418219
xor bl, bl
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4182b7
mov edx, dword [esi + 8]
mov eax, edx
mov ecx, dword [esi + 0xc]
or eax, ecx
mov dword [ebp - 4], 1
je 0x4182ac
cmp dword [esi], 0
je 0x4182ac
push 0x4000
push dword [esi + 0x10]
push ecx
push edx
push dword [esi + 4]
call fcn.00418470
push 0x18
push esi
call fcn.0041f75c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret