joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a24e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x435084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00412ff5
and dword [ebp - 0x14], 0
cmp dword [0x4378cc], 0
mov dword [ebp - 0x18], eax
jne 0x41a301
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41a3a9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41a3a9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4378cc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4378d0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4378d4], eax
call edi
push eax
call esi
mov dword [0x4378dc], eax
test eax, eax
je 0x41a301
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4378d8], eax
mov eax, dword [0x4378d8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41a35a
cmp dword [0x4378dc], ecx
je 0x41a35a
push eax
call esi
push dword [0x4378dc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41a35a
test ebx, ebx
je 0x41a35a
call edi
test eax, eax
je 0x41a351
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41a351
test byte [ebp - 8], 1
jne 0x41a35a
or dword [ebp + 0x10], 0x200000
jmp 0x41a38d
mov eax, dword [0x4378d0]
cmp eax, dword [ebp - 0x18]
je 0x41a38d
push eax
call esi
test eax, eax
je 0x41a38d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41a38d
mov eax, dword [0x4378d4]
cmp eax, dword [ebp - 0x18]
je 0x41a38d
push eax
call esi
test eax, eax
je 0x41a38d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4378cc]
call esi
test eax, eax
je 0x41a3a9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41a3ab
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410f34
leave
ret
Function at 0x10005f40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10005f9d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10005f9d
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10005f8a
cmp esi, edx
jae 0x10005f9d
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10005f78
cmp esi, edx
jae 0x10005f9d
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10006640
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push 0x40
mov dword [ebp - 0x8c], eax
mov ebx, ecx
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov al, byte [ebp + 0x10]
add esp, 0x18
mov ecx, dword [ebp + 8]
mov byte [ebp - 0x42], al
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x41], al
lea eax, [ebp - 0x44]
push 0x25
mov byte [ebp - 0x40], cl
mov ecx, ebx
push eax
mov word [ebp - 0x44], 4
call fcn.10006930
movsx eax, al
test eax, eax
jne 0x1000676b
cmp dword [ebx + 0x70], 0xffffffff
je 0x1000679b
push edi
mov dword [ebp - 0x88], eax
xor edi, edi
push esi
lea ecx, [ebx + 0x78]
push ecx
lea eax, [ebp - 0x88]
push eax
movzx eax, word [ebx + 4]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebx + 0x70]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x100066fc
cmp eax, 0x3e5
jne 0x10006783
push 0x64
push dword [ebx + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebx + 0x70]
test eax, eax
jne 0x1000677c
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebx + 0x78]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x10006736
inc edi
cmp byte [ebp - 0x84], 5
je 0x1000674d
cmp edi, 0xa
ja 0x10006783
jmp 0x100066c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x48f
je 0x10006783
cmp eax, 0x1f
je 0x10006783
jmp 0x100066c5
movzx eax, byte [ebp + 0x10]
lea ecx, [ebp - 0x83]
push eax
push ecx
push dword [ebp - 0x8c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_CancelIo]
pop esi
pop edi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.1005078e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov al, byte [ebp + 8]
push ebx
mov dword [ebp - 4], ecx
mov bl, 1
mov byte [edx], al
cmp dword [ecx + 0x70], 0xffffffff
je 0x10006919
lea eax, [ecx + 0x78]
xor ebx, ebx
push esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
push edi
jmp 0x10006873
mov ecx, dword [ebp - 4]
movzx esi, word [ecx + 4]
cmp eax, esi
cmova esi, eax
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
add esp, 0x1c
mov dword [ebp - 8], 0
push dword [ebp + 8]
push eax
movzx eax, word [ecx + 4]
push eax
push edi
push dword [ecx + 0x70]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0x10]
mov esi, eax
push edi
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memcpy
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x10
test esi, esi
jne 0x100068e2
mov eax, dword [ebp + 0x10]
inc ebx
cmp ebx, 2
jl 0x10006870
mov esi, dword [ebp - 4]
push 0x64
push dword [esi + 0x74]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000690e
mov eax, dword [esi + 0x70]
cmp eax, 0xffffffff
je 0x10006903
push eax
call dword [sym.imp.KERNEL32.dll_CancelIo]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100069d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10006a2b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10006a2b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10006a1a
cmp esi, edx
jae 0x10006a2b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10006a08
cmp esi, edx
jae 0x10006a2b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10007910
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push esi
push edi
push 0x1005d8c4
mov dword [ebp - 0xf0], eax
mov edi, ecx
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xe8], 0
push 0x14
push eax
xor esi, esi
call ebx
movzx eax, word [edi + 4]
push eax
lea eax, [ebp - 0x54]
push 0x1005d86c
push eax
call fcn.10006a30
lea ecx, [ebp - 0x54]
add esp, 0x18
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007970
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jne 0x10007990
movzx eax, word [edi + 4]
push eax
push 0x1005d874
jmp 0x100079b0
cmp ecx, 2
jne 0x100079a1
movzx eax, word [edi + 4]
push eax
push str.00_x
jmp 0x100079b0
cmp ecx, 1
jne 0x100079bc
movzx eax, word [edi + 4]
push eax
push str.000_x
lea eax, [ebp - 0x54]
push eax
call fcn.10006a30
add esp, 0xc
movzx eax, word [edi + 6]
push eax
lea eax, [ebp - 0x2c]
push 0x1005d86c
push eax
call fcn.10006a30
lea ecx, [ebp - 0x2c]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100079e0
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jne 0x10007a00
movzx eax, word [edi + 6]
push eax
push 0x1005d874
jmp 0x10007a20
cmp ecx, 2
jne 0x10007a11
movzx eax, word [edi + 6]
push eax
push str.00_x
jmp 0x10007a20
cmp ecx, 1
jne 0x10007a2c
movzx eax, word [edi + 6]
push eax
push str.000_x
lea eax, [ebp - 0x2c]
push eax
call fcn.10006a30
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xb8]
push str._s_s
push eax
call fcn.10006a30
push str.SOFTWARERAZER_
lea eax, [ebp - 0x90]
push 0x1e
push eax
call ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x90]
push 0x1e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xe8]
add esp, 0x28
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x90]
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x10007abb
mov ecx, edi
call fcn.10006ec0
lea eax, [ebp - 0xe8]
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x90]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x10007b0a
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], 1
push eax
lea eax, [ebp - 0xe1]
push eax
push 0
push 0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x10007afe
mov eax, dword [ebp - 0xf0]
mov cl, byte [ebp - 0xe1]
mov byte [eax], cl
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
and esi, 0x80004005
mov eax, esi
pop esi
pop ebx
call fcn.1005078e
mov esp, ebp
pop ebp
ret 4
Function at 0x10008550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0xe0]
push esi
push edi
push 0x1005d8c4
push 0x14
push eax
mov edi, ecx
mov dword [ebp - 0xe8], 0
xor esi, esi
call ebx
movzx eax, word [edi + 4]
push eax
lea eax, [ebp - 0x54]
push 0x1005d86c
push eax
call fcn.10006a30
lea ecx, [ebp - 0x54]
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100085a6
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jne 0x100085c6
movzx eax, word [edi + 4]
push eax
push 0x1005d874
jmp 0x100085e6
cmp ecx, 2
jne 0x100085d7
movzx eax, word [edi + 4]
push eax
push str.00_x
jmp 0x100085e6
cmp ecx, 1
jne 0x100085f2
movzx eax, word [edi + 4]
push eax
push str.000_x
lea eax, [ebp - 0x54]
push eax
call fcn.10006a30
add esp, 0xc
movzx eax, word [edi + 6]
push eax
lea eax, [ebp - 0x2c]
push 0x1005d86c
push eax
call fcn.10006a30
lea ecx, [ebp - 0x2c]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008610
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jne 0x10008630
movzx eax, word [edi + 6]
push eax
push 0x1005d874
jmp 0x10008650
cmp ecx, 2
jne 0x10008641
movzx eax, word [edi + 6]
push eax
push str.00_x
jmp 0x10008650
cmp ecx, 1
jne 0x1000865c
movzx eax, word [edi + 6]
push eax
push str.000_x
lea eax, [ebp - 0x2c]
push eax
call fcn.10006a30
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xb8]
push str._s_s
push eax
call fcn.10006a30
push str.SOFTWARERAZER_
lea eax, [ebp - 0x90]
push 0x1e
push eax
call ebx
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x90]
push 0x1e
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xe8]
add esp, 0x28
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x90]
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x100086eb
mov ecx, edi
call fcn.10006ec0
lea eax, [ebp - 0xe8]
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x90]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x10008722
mov al, byte [ebp + 8]
push 1
mov byte [ebp - 0xe1], al
lea eax, [ebp - 0xe1]
push eax
push 3
push 0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0xe8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xe8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
neg esi
pop edi
sbb esi, esi
xor ecx, ebp
and esi, 0x80004005
mov eax, esi
pop esi
pop ebx
call fcn.1005078e
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b4d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x1000b502
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000b4f0
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x1000c280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 8
jb 0x1000c2bd
mov ecx, dword [edi]
mov dword [ebp - 0x14], ecx
mov edx, dword [edi + 0x10]
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x1000c2e8
mov edi, dword [ebp - 0x14]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1000c2d1
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push esi
push edi
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.1000b0c0
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1000c318
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x71c71c7
je 0x1000c43b
add eax, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.1005021f
mov dword [ebp + 0xc], eax
xorps xmm0, xmm0
movups xmmword [eax + 8], xmm0
mov dword [ebp - 0x18], eax
xor ecx, ecx
add eax, 8
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], cx
mov byte [ebp - 4], 1
mov dword [eax + 0x18], ecx
mov dword [ebp - 4], 3
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1000c400
mov ecx, edi
call fcn.100321b0
mov eax, dword [ebp + 0xc]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000b0c0
mov ecx, dword [eax]
jmp 0x1000c403
mov ecx, dword [ebp - 0x24]
push dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
push ecx
push esi
mov ecx, edi
call fcn.10031c70
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov byte [ecx + 4], 1
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1000cb30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1000b050
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10012340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100540b4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov byte [ebp - 4], 1
lea esi, [edi + 0x10]
mov dword [ebp - 0x24], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [ebp - 4], 2
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 4
lea eax, [edi + 0x20]
mov dword [ebp - 0x28], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 5
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 7
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ebx
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x10012412
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov byte [ebp - 4], 9
lea ecx, [edi + 0x70]
mov al, byte [ebp + 0x34]
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.10014420
mov byte [ebp - 4], 0xa
xor ebx, ebx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], edx
test ecx, ecx
jns 0x1001245c
mov eax, ecx
neg eax
cmp ebx, eax
jae 0x1001245c
add ecx, ebx
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x10012466
add ecx, ebx
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10031b00
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x100124a2
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov dword [ebp + 0x30], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x10012a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100542e1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x24]
mov eax, dword [esi]
mov dword [edi], eax
movups xmm0, xmmword [esi + 8]
movups xmmword [edi + 8], xmm0
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
lea eax, [esi + 0x24]
push eax
call fcn.100121a0
mov dword [ebp - 4], 0
lea eax, [esi + 0x3c]
push eax
lea ecx, [edi + 0x3c]
call fcn.10011e80
mov byte [ebp - 4], 1
lea ecx, [edi + 0x60]
movzx eax, byte [esi + 0x54]
mov byte [edi + 0x54], al
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movzx eax, byte [esi + 0x5c]
mov byte [edi + 0x5c], al
lea eax, [esi + 0x60]
push eax
call fcn.100121a0
mov byte [ebp - 4], 2
lea ecx, [edi + 0x7c]
movzx eax, byte [esi + 0x78]
mov byte [edi + 0x78], al
lea eax, [esi + 0x7c]
push eax
call fcn.100121a0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10018b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, eax
cmp dword [eax + 0x14], 8
jb 0x10018b82
mov esi, dword [eax]
mov edi, dword [eax + 0x10]
mov edx, 0x811c9dc5
mov ecx, 0
add edi, edi
je 0x10018ba4
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10018b93
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x10018bb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x10019bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 3
xorps xmm2, xmm2
xorps xmm1, xmm1
movups xmm0, xmmword [ecx + edx]
pxor xmm2, xmm0
movups xmm0, xmmword [ecx + edx + 0x10]
add ecx, 0x20
pxor xmm1, xmm0
cmp ecx, 0x42
jle 0x10019bd1
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd eax, xmm1
cmp ecx, 0x58
jg 0x10019c30
xor al, byte [ecx + edx]
inc ecx
cmp ecx, 0x58
jle 0x10019c27
pop ebp
ret 8