joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2d8d6ffa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x2d8d7009
pop dword [ebp - 0x2c]
mov eax, 0x2d8d7009
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x89301ec3
sub dword [ebp - 0x3c], 0x3addd978
mov dword [ebp - 0x38], 0xbdca4792
sub dword [ebp - 0x38], 0x8b96fb4d
mov dword [ebp - 0x34], 0x6b1e2190
add dword [ebp - 0x34], 0xe12e229e
mov dword [ebp - 0x30], 0x51c42556
add dword [ebp - 0x30], 0xae3bdaaa
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x3859b40d
sub dword [ebp - 0x3c], 0xc3e74ab7
mov dword [ebp - 0x38], 0xb917ddd7
sub dword [ebp - 0x38], 0x77ab7c62
mov dword [ebp - 0x34], 0xbfa5837d
add dword [ebp - 0x34], 0xa3c9e8ef
mov dword [ebp - 0x30], 0xfcc32fca
add dword [ebp - 0x30], 0x33cd036
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x6c289
push 0
call eax
mov ecx, 0xbed0738a
sub ecx, 0xbed027ad
mov esi, eax
mov edx, 0x4c28ab76
add edx, 0xe172348a
add edx, dword [ebp - 0x2c]
mov ebx, 0x199f711d
add ebx, 0x3fee89ec
xor dword [ebp - 0x14], 0x872b0cd9
mov edi, dword [edx]
add dword [ebp - 0x24], 0xadad99a2
add edi, ebx
sub dword [ebp - 0x14], edx
mov dword [esi], edi
xor dword [ebp - 0x28], 0x3eb090e
add esi, 4
add edx, 0x40e59fad
sub edx, 0x40e59fa9
loop 0x2d8d711c
add eax, 0x3ac48ef
add eax, 0xfc54d958
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x875aa443
sub ecx, 0x59daa443
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5a5d59ab
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x900e34b5
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
nop
mov ecx, 0x743a1586
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x75274bc3
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1af0459d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5b7c34e2
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x410c92
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4173c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040bc68
and dword [ebp - 0x14], 0
cmp dword [0x8148a0], 0
mov dword [ebp - 0x18], eax
jne 0x410d45
push 0x403e78
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410ded
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e6c
push ebx
call edi
test eax, eax
je 0x410ded
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e5c
push ebx
mov dword [0x8148a0], eax
call edi
push eax
call esi
push 0x403e48
push ebx
mov dword [0x8148a4], eax
call edi
push eax
call esi
push 0x403e2c
push ebx
mov dword [0x8148a8], eax
call edi
push eax
call esi
mov dword [0x8148b0], eax
test eax, eax
je 0x410d45
push 0x403e14
push ebx
call edi
push eax
call esi
mov dword [0x8148ac], eax
mov eax, dword [0x8148ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410d9e
cmp dword [0x8148b0], ecx
je 0x410d9e
push eax
call esi
push dword [0x8148b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410d9e
test ebx, ebx
je 0x410d9e
call edi
test eax, eax
je 0x410d95
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x410d95
test byte [ebp - 8], 1
jne 0x410d9e
or dword [ebp + 0x10], 0x200000
jmp 0x410dd1
mov eax, dword [0x8148a4]
cmp eax, dword [ebp - 0x18]
je 0x410dd1
push eax
call esi
test eax, eax
je 0x410dd1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x410dd1
mov eax, dword [0x8148a8]
cmp eax, dword [ebp - 0x18]
je 0x410dd1
push eax
call esi
test eax, eax
je 0x410dd1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8148a0]
call esi
test eax, eax
je 0x410ded
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410def
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004085a1
leave
ret
Function at 0x4133e0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1b08
call fcn.004116f0
cmp dword [0x8965b4], 0x37
push esi
jne 0x4134da
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x30c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
call esi
push 0x403f04
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea eax, [esp + 0xb0c]
push eax
push 0x403f44
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x130c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0xe8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call esi
push 0x403f64
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea eax, [esp + 0x24]
push 0
push eax
mov dword [esp + 0x28], 0
call fcn.0040e6b0
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov edx, dword [0x8969f0]
mov dword [esp + 8], edx
mov eax, 0x5d1
add dword [esp + 8], eax
mov eax, dword [esp + 8]
mov cl, byte [eax + edi]
mov edx, dword [0x894dac]
mov byte [edx + edi], cl
pop esi
add esp, 0x1b08
ret
Function at 0x1a9556c
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], 0x640008eb
jno 0x1a95572
jmp 0x1a95576
add byte [eax], al
add byte [eax], al
pushal
call 0x1a9557c
pop ebp
sub ebp, 0x10
sub ebp, 0x169556c
jmp 0x1a95592
mov eax, 0x169556c
add eax, ebp
add eax, 0x4c
mov ecx, 0x609
mov edx, 0x6a8a5392
xor byte [eax], dl
inc eax
dec ecx
jne 0x1a955a9
jmp 0x1a955bc
sbb dword [edi + 0x19], ebx
sbb ebp, dword [esi + 0x13929292]
push ebx
push 0xffffffffffffff92
xchg edx, eax
xchg edx, eax
xchg ecx, eax
pop edi
sub bl, byte [ebx + 0x28929292]
mov edx, 0x65929292
jo 0x1a9556a
pop edx
sbb dword [ebx], edx
sahf
xchg edx, eax
xchg edx, eax
xchg edx, eax
xchg ecx, eax
push edi
pop ds
div byte [esi - 0x4969e492]
ret 0x52fa

Function at 0x422be0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x422d3e
nop
jl 0x422c37
int1
ror dword [edi], 1
push cs
cmpsb byte [esi], byte es:[edi]
jb 0x422c2b
push cs
sbb ah, cl
popal
loope 0x422c54
popal
popal
popal
popal
popal
jnp 0x422bf1
mov bh, 0x79
div byte [esi - 0x97bd510]
jp 0x422bf3
jb 0x422c25
or eax, 0x1c832ae0
dec ecx
invalid
jb 0x422c46
or eax, 0x15822ae0
sar byte [eax], 0x72
adc eax, 0x197238c0
cmp esp, 0x30
sbb edx, esi
cmp esp, 0x30
adc ecx, edi
stc
jnp 0x422c2f
div dword [edi - 0x7af1fe8e]
test dword [eax + 0x34], edi
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
mov bh, 0x72
add dword [esi], ecx
test dword [ebp + 0x2af03478], eax
test dh, dh
jp 0x422c35
jb 0x422c67
or eax, 0x38e02ae0
lock sub al, byte [esi + esi*8 + 0x1f72ef7a]
pop ds
or eax, 0x38e02ae0
test cl, dl
mov al, 0xf0
sub al, byte [esi + esi*8 + 0x1f72ef7a]
or eax, 0x38e02ae0
lock sub al, byte [edx + 0x7af8841e]
sub ah, al
cmp al, dh
sub al, byte [edx + 0x7af8841e]
out dx, eax
jb 0x422c93
or eax, 0x15822ae0
jb 0x422cab
xor bl, dh
jo 0x422c8a
jo 0x422c8a
int1
add cl, byte [esi]
push cs
jb 0x422ca4
invalid
or eax, 0xf37bfe87
mov bl, 0x79
div byte [esi + 0x180684b8]
xchg edx, eax
mov eax, 0x92180684
push cs
push cs
push cs
popal
jp 0x422c91
jb 0x422cd3
cmc
js 0x422c99
jb 0x422cdb
cmc
cmc
jb 0x422cc0
cmc
xchg byte [eax], al
lock sbb byte ds:[ebp - 0x50f1f1f2], bh
scasd eax, dword es:[edi]
js 0x422cbb
dec eax
int1
int1
int1
jnp 0x422cb2
div byte [esi - 0xf32e623]
xchg byte [esi], al
mov dh, 0xdd
sbb ebp, ecx
lock xchg byte [esi], al
jno 0x422c93
test byte [ebx], al
jp 0x422cc0
jnp 0x422c7a
cmc
xchg edi, eax
xor byte [ecx], bl
stc
xor byte [ecx], dh
loope 0x422d4c
xor eax, 0x1a7109d8
sbb eax, esi
add dword [eax - 0xa], edi
lock add dword [eax - 0xa], edi
jb 0x422d17
hlt
mov dh, 0xa1
mov dh, 0x48
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xea45f03
sbb dword [bp - 0xe0e], esp
clc
xor dword [ebp + 0x72f278f6], eax
xor dh, ch
sbb ch, byte [ecx]
push cs
sbb eax, 0x90f1f2a6
sbb byte [ebx], dl
in eax, dx
std
inc dword [eax]
mov eax, section._4321280
xor byte [eax], 0x56
inc eax
cmp eax, 0x422bcc
jle 0x422d43
mov eax, 0x422be6
xor byte [eax], 0xf1
inc eax
cmp eax, 0x422d38
jle 0x422d53
pushal
mov esi, section._4321280
jmp 0x422be5
Function at 0x40e680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40e802
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40e802
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edi, dword [edi]
push eax
push edi
push esi
mov esi, dword [esi]
mov edi, dword [edi]
test eax, 0x1f
je 0x40e6b8
mov dl, byte [esi + eax - 1]
mov byte [esi + eax], dl
vpxor ymm0, ymm0, ymm0
vpcmpeqb xmm7, xmm7, xmm7
vpsrldq xmm7, xmm7, 0xf
vpand ymm7, ymm7, ymmword [esi]
add eax, 0x1f
and eax, 0xffffffe0
cmp eax, 0x20
ja 0x40e6f0
vpcmpeqb xmm6, xmm6, xmm6
vpslldq xmm6, xmm6, 0xf
vperm2i128 ymm6, ymm6, ymm6, 1
vpand ymm6, ymm6, ymmword [esi]
jmp 0x40e700
vmovdqu ymm6, ymmword [esi + 0x20]
vperm2i128 ymm6, ymm0, ymm6, 0x20
vpslldq ymm6, ymm6, 0xf
vmovdqu ymm1, ymmword [esi]
vperm2i128 ymm2, ymm0, ymm1, 0x20
vpalignr ymm2, ymm1, ymm2, 0xf
vperm2i128 ymm4, ymm0, ymm1, 3
vpalignr ymm3, ymm4, ymm1, 1
vpor ymm2, ymm2, ymm7
vpor ymm3, ymm3, ymm6
vpsrldq ymm7, ymm4, 0xf
vpunpckhbw ymm4, ymm1, ymm0
vpunpcklbw ymm5, ymm1, ymm0
vperm2i128 ymm1, ymm5, ymm4, 0x20
vperm2i128 ymm4, ymm5, ymm4, 0x31
vpunpckhbw ymm5, ymm2, ymm0
vpunpcklbw ymm6, ymm2, ymm0
vperm2i128 ymm2, ymm6, ymm5, 0x20
vperm2i128 ymm5, ymm6, ymm5, 0x31
vpunpckhbw ymm6, ymm3, ymm0
vpunpcklbw ymm0, ymm3, ymm0
vperm2i128 ymm3, ymm0, ymm6, 0x20
vperm2i128 ymm6, ymm0, ymm6, 0x31
vpxor ymm0, ymm0, ymm0
vpmullw ymm1, ymm1, ymmword [0x777060]
vpmullw ymm4, ymm4, ymmword [0x777060]
vpaddw ymm2, ymm2, ymmword [0x777020]
vpaddw ymm5, ymm5, ymmword [0x777020]
vpaddw ymm3, ymm3, ymmword [0x777040]
vpaddw ymm6, ymm6, ymmword [0x777040]
vpaddw ymm2, ymm2, ymm1
vpaddw ymm5, ymm5, ymm4
vpsrlw ymm2, ymm2, 2
vpsrlw ymm5, ymm5, 2
vpaddw ymm3, ymm3, ymm1
vpaddw ymm6, ymm6, ymm4
vpsrlw ymm3, ymm3, 2
vpsrlw ymm6, ymm6, 2
vpsllw ymm3, ymm3, 8
vpsllw ymm6, ymm6, 8
vpor ymm2, ymm2, ymm3
vpor ymm5, ymm5, ymm6
vmovdqu ymmword [edi], ymm2
vmovdqu ymmword [edi + 0x20], ymm5
sub eax, 0x20
add esi, 0x20
add edi, 0x40
cmp eax, 0x20
ja 0x40e6f0
test eax, eax
jne 0x40e6d4
pop esi
pop edi
pop eax
add esi, 4
add edi, 4
dec ecx
jg 0x40e6a3
vzeroupper
pop edi
pop esi
pop ebp
ret
Function at 0x41ad90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x41adbb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41ada4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x41baa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51159f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x79b0b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.0044f54e
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x41bb51
push eax
push esi
call fcn.0044fbf3
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x5107b0
call fcn.0044f832
int3
Function at 0x41d0e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511a25
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x79b0b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x7a0ad8]
mov edx, dword [0x7a0adc]
mov edi, dword [ebp + 0xc]
and ebx, edi
mov eax, dword [ebp + 0x10]
and edx, eax
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
sub ecx, ebx
mov eax, dword [ebp + 0x18]
push ecx
push ebx
push edx
push 0xf001f
push dword [esi + 4]
sbb eax, edx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, 0x5108d0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x2c], 0
mov esi, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x3c], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d173
sub ecx, edx
push ecx
push 0x5108d0
lea ecx, [ebp - 0x3c]
call fcn.0042b3c0
mov dword [ebp - 4], 0
test esi, esi
je 0x41d21e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0042b1f0
sub edi, ebx
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
add edi, esi
push 0x7a0aa8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0x7a0aa8
mov byte [ebp - 0x18], 0
call fcn.00450336
add esp, 4
test eax, eax
jne 0x41d23d
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], 1
lea eax, [ebp - 0x20]
push eax
call fcn.004281e0
mov dword [eax], esi
mov dword [ebp - 4], 0xffffffff
push 0x7a0aa8
call fcn.0045035b
mov eax, dword [ebp - 0x20]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00462b2c
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebp - 0x3c]
push eax
push 0x79f8e0
call fcn.0042e3b0
add esp, 4
mov ecx, eax
call fcn.00428580
push 0xffffffffffffffff
call fcn.00467dae
push eax
call fcn.0044f647
int3
Function at 0x41d250
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511a5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x79b0b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0x7a0aa8
push 0x7a0aa8
mov byte [ebp - 0x18], 0
call fcn.00450336
add esp, 4
test eax, eax
jne 0x41d40f
mov bl, 1
mov byte [ebp - 0x18], bl
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00435df0
mov eax, dword [eax + 4]
test eax, eax
je 0x41d3c5
mov esi, dword [0x7a0a8c]
cmp eax, esi
je 0x41d3c5
movzx ecx, byte [eax + 8]
xor ecx, 0x811c9dc5
mov edi, dword [eax + 0xc]
imul edx, ecx, 0x1000193
movzx ecx, byte [eax + 9]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
mov ecx, dword [0x7a0a94]
imul edx, edx, 0x1000193
and edx, dword [0x7a0aa0]
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x41d366
cmp ecx, eax
jne 0x41d35e
mov dword [edx], esi
mov dword [edx + 4], esi
jmp 0x41d36e
mov esi, dword [eax + 4]
mov dword [edx + 4], esi
jmp 0x41d36e
cmp ecx, eax
jne 0x41d36e
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
dec dword [0x7a0a90]
mov ecx, dword [eax + 4]
push 0x10
push eax
mov dword [ecx], edx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
call fcn.00462fc9
add esp, 8
mov dword [ebp - 4], 0xffffffff
push 0x7a0aa8
call fcn.0045035b
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x41d3f1
push 0x510900
push 0x79f8e0
call fcn.0042e410
push eax
call fcn.0042e3d0
add esp, 0xc
jmp 0x41d3f1
push 0x510840
push 0x79f8e0
call fcn.0042e410
push eax
call fcn.0042e3d0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
push 0x7a0aa8
call fcn.0045035b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00462b2c
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.0044f647
int3
Function at 0x41d500
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511b2f
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x79b0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x280], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x27c], 0
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x27c], 1
jb 0x41d587
mov edx, dword [edx]
lea eax, [ebp - 0x278]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41d6a9
xor eax, eax
mov dword [ebp - 0x28], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x18], 0
lea edx, [eax + 2]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41d5d2
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0042afb0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x510870
call fcn.004286b0
test eax, eax
je 0x41d63e
push 0x510880
lea ecx, [ebp - 0x28]
call fcn.004286b0
test eax, eax
je 0x41d63e
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [esi + 8]
je 0x41d636
mov edx, eax
call fcn.0042fef0
add esp, 4
add dword [esi + 4], 0x18
jmp 0x41d63e
push eax
mov ecx, esi
call fcn.0042ff90
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x41d678
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41d66e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d6c6
push edx
push ecx
call fcn.00462fc9
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x278]
push eax
push edi
mov dword [ebp - 0x14], 7
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41d5a0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00462b2c
mov esp, ebp
pop ebp
ret
call fcn.0046d997
int3