joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010d050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ac086
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10373f78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 1
mov dword [edi + 4], 0
mov dword [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov byte [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 2
lea esi, [edi + 0x58]
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10264bfb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x60], 1
mov dword [edi + 0x68], 3
mov dword [edi + 0x70], 5
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0xe10
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 3
mov dword [edi + 0x84], 1
mov dword [edi + 0x88], 0x258
mov dword [edi + 0x8c], 0
mov byte [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10114180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [edi], 0
mov dword [ecx], 0
cmp edi, edx
je 0x101141e3
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
cmp ecx, edx
je 0x101141e3
mov eax, dword [edx]
mov dword [edx], 0
push ebx
mov ebx, dword [ecx]
mov dword [ecx], eax
test ebx, ebx
je 0x101141db
cmp byte [ebx + 4], 0
je 0x101141d0
push esi
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
push 8
push ebx
call fcn.1026505f
add esp, 8
pop ebx
mov eax, edi
pop edi
pop ebp
ret 4
mov eax, edi
pop edi
pop ebp
ret 4

Function at 0x101141f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
cmp edi, ecx
je 0x10114247
mov eax, dword [ecx]
lea edx, [edi + 4]
add ecx, 4
mov dword [edi], eax
cmp edx, ecx
je 0x10114247
mov eax, dword [ecx]
mov dword [ecx], 0
push ebx
mov ebx, dword [edx]
mov dword [edx], eax
test ebx, ebx
je 0x1011423f
cmp byte [ebx + 4], 0
je 0x10114234
push esi
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
push 8
push ebx
call fcn.1026505f
add esp, 8
pop ebx
mov eax, edi
pop edi
pop ebp
ret 4
mov eax, edi
pop edi
pop ebp
ret 4
Function at 0x101182f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102acc8b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10373f78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov edx, dword [ebp + 0xc]
lea ecx, [edi + 0x10]
push dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], edx
call fcn.1004dac0
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
push esi
mov dword [ebp - 4], 0
call fcn.1004dac0
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x40]
call fcn.1004dac0
mov al, byte [esi + 0x30]
mov byte [edi + 0x58], al
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1011d450
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ad75b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x2c]
mov ecx, 0x1038af58
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 0x1038af50
mov dword [0x1038af50], 0x10341d5c
mov dword [0x1038af54], 0x10341d4c
call fcn.1011dc00
mov ecx, 0x1038af78
mov dword [ebp - 4], 0
call fcn.1011dc00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x28], 0
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1011d4f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.1004f0f0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 3
push eax
mov ecx, 0x1038af78
mov dword [ebp - 0x30], edi
call fcn.1011dbe0
lea ecx, [ebp - 0x28]
cmp eax, ecx
je 0x1011d538
cmp dword [ebp - 0x14], 8
push dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.1004f0f0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1011d576
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1011d56c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011d605
push edx
push ecx
call fcn.1026505f
add esp, 8
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.1008cdc0
mov esi, eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 4
push eax
mov ecx, 0x1038af58
mov dword [ebp - 0x30], edi
call fcn.1011dbe0
cmp eax, esi
je 0x1011d5af
cmp dword [esi + 0x14], 8
mov ecx, dword [esi + 0x10]
jb 0x1011d5a6
mov esi, dword [esi]
push ecx
push esi
mov ecx, eax
call fcn.1004f0f0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1011d5e5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1011d5db
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011d60a
push edx
push ecx
call fcn.1026505f
add esp, 8
mov eax, 0x1038af50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
call fcn.10275373
call fcn.10275373
int3
Function at 0x1011db70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.100d8e60
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x1011dbce
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.1024e995
int3
Function at 0x1011dd00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ad885
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10373f78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100d8e60
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1011dd93
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x71c71c7
je 0x1011defe
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x10], 0
call fcn.10264bfb
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov dword [ebp - 4], 3
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10343080]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10343080]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1011de9d
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call fcn.102967e0
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10265790
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1011de7c
cmp ebx, 0x200
jae 0x1011de7a
shl ebx, 3
cmp ebx, ecx
jae 0x1011de7c
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100fd230
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100d8e60
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x1011dea0
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1011dece
mov dword [ecx + eax*8], esi
jmp 0x1011dedd
cmp edi, edx
jne 0x1011ded7
mov dword [ecx + eax*8], esi
jmp 0x1011dee1
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1011dee1
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1024e975
int3
Function at 0x1011fd10
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102adc71
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x28], 0
push 0x13
xor eax, eax
mov dword [ebp - 0x18], 0
push str.set_dump_type_to_0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
call fcn.1004f0f0
lea edx, [esi + 0x30]
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.100a9730
mov dword [ebp - 0x44], 0xc
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 3
push ecx
lea eax, [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x54]
call fcn.10051dd0
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.10059130
add esp, 4
mov dword [ebp - 0x44], 0xe
lea ecx, [ebp - 0x54]
call fcn.1004eed0
push fcn.1004a960
push 1
push 0x18
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 2
push eax
call fcn.10264c2b
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1011fe1b
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1011fe11
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1011fe3a
push edx
push ecx
call fcn.1026505f
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret 4
call fcn.10275373
int3
Function at 0x10126b90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [0x10373f78]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
mov eax, 1
lea edi, [esp + 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movaps xmmword [esp + 0x14], xmm0
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
test dword [esp + 0x18], 0x80000000
jne 0x10126bed
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
mov eax, 0x40000000
lea edi, [esp + 0x10]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x3c], 0
push eax
mov dword [esp + 0x18], 0x7263694d
mov dword [esp + 0x1c], 0x666f736f
mov word [esp + 0x20], 0x74
call fcn.102675c0
add esp, 8
test eax, eax
je 0x10126c7f
call fcn.10048fd0
lea ecx, [esp + 0x2c]
push ecx
push str.Hypervisor_has_been_detected._Name:__0
push ecx
mov ecx, eax
call fcn.10127f20
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
call fcn.10048fd0
lea ecx, [esp + 0x2c]
push ecx
push str.Seems__app_is_working_on_a_VM:_a_Hypervisor_has_been_detected._Name:__0
push ecx
mov ecx, eax
call fcn.10127f20
mov ecx, dword [esp + 0x3c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
Function at 0x10126cb0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ae4b9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10126b90
cmp eax, 1
je 0x10126e49
test eax, eax
je 0x10126dec
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
rdtsc
mov dword [ebp - 0x30], eax
rdtsc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x30]
cmp eax, 0x1f4
jbe 0x10126d25
call fcn.10048fd0
push str.Seems__app_is_working_on_a_VM.__CPU_time_diff_detected_
jmp 0x10126e40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10389454]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1038b048]
cmp eax, dword [ecx + 4]
jg 0x10126e67
lea ecx, [ebp - 0x28]
call fcn.10126960
cmp dword [ebp - 0x14], 8
mov esi, 0x1038b000
mov edi, dword [ebp - 0x28]
setae bl
nop dword [eax]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10126d6a
mov eax, dword [esi]
push dword [esi + 0x10]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
test bl, bl
push eax
cmovne ecx, edi
push 0
call fcn.1005efa0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x10126df0
add esi, 0x18
cmp esi, 0x1038b048
jne 0x10126d60
test bl, bl
je 0x10126dc9
mov eax, dword [ebp - 0x14]
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10126dbf
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10126edc
push ecx
push edi
call fcn.1026505f
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
call fcn.10048fd0
push str.No_signs_of_a_virtual_environment_has_been_detected
push 1
mov ecx, eax
call fcn.100511c0
xor al, al
jmp 0x10126e4b
test bl, bl
je 0x10126e26
mov eax, dword [ebp - 0x14]
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10126e1c
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10126edc
push ecx
push edi
call fcn.1026505f
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x18], eax
call fcn.10048fd0
push str.Seems__app_is_working_on_a_VM.__SMBIOS_info_detected_
push 1
mov ecx, eax
call fcn.100511c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
push 0x1038b048
call fcn.10264b25
add esp, 4
cmp dword [0x1038b048], 0xffffffff
jne 0x10126d45
push str.VBOX
mov ecx, 0x1038b000
call fcn.1004da30
push str.QEMU
mov ecx, 0x1038b018
mov dword [ebp - 4], 0
call fcn.1004da30
push str.BOCHS
mov ecx, 0x1038b030
mov byte [ebp - 4], 1
call fcn.1004da30
push 0x102b5f70
mov dword [ebp - 4], 0xffffffff
call fcn.10265045
push 0x1038b048
call fcn.10264adb
add esp, 8
jmp 0x10126d45
call fcn.10275373
int3
Function at 0x10128bd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x1038af9c
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100d8e60
mov eax, dword [eax + 4]
test eax, eax
je 0x10128c3d
cmp eax, dword [0x1038afa0]
je 0x10128c3d
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10128c50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ae895
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10373f78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.100d8e60
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10128d7b
cmp dword [esi + 8], 0xfffffff
je 0x10128d92
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.10264bfb
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10343080]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10343080]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x10128d6b
mov ecx, esi
call fcn.100fd020
mov edi, dword [ebp + 8]
mov ecx, esi
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100d8e60
mov ecx, dword [eax]
jmp 0x10128d71
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 8]
push edi
push ecx
push ebx
mov ecx, esi
call fcn.100fd0b0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.1024e975
int3
Function at 0x1012c2d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102aedcc
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10373f78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [edi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 0x1032c980
push 1
push 0
push 0x1032c970
mov dword [ebp - 0x10], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1012c436
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [edi]
test ecx, ecx
je 0x1012c345
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov dword [edi], ebx
mov dword [ebp - 0x14], 0
mov eax, dword [ebx]
push 0xc
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.10264bfb
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x1012c3a2
mov ebx, dword [ebp + 8]
push ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
jne 0x1012c39d
test ebx, ebx
jne 0x1012c44a
mov ebx, dword [ebp - 0x18]
jmp 0x1012c3a4
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 8], esi
test esi, esi
je 0x1012c454
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
push ebx
call dword [ebp - 0x1c]
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1012c190
test esi, esi
jns 0x1012c3fe
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 3
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1012c415
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push esi
mov dword [edi + 4], esi
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.102972f0
push 0x8007000e
call fcn.102972f0
int3
Function at 0x1012f0d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102af520
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov eax, dword [eax + esi + 0x30]
mov edi, dword [eax + 4]
mov ecx, edi
mov dword [ebp - 0x48], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x4c]
push eax
call fcn.1005d4f0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 0x44], al
test edi, edi
je 0x1012f143
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x1012f143
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0x44]
mov ecx, esi
call fcn.100f9ef0
mov ecx, esi
call fcn.10050770
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1012edd0
mov eax, dword [0x10385e38]
test eax, eax
je 0x1012f19a
lea ecx, [ebp - 0x28]
push ecx
push dword [esi + 0x9c]
push dword [esi + 0xa0]
push dword [esi + 0x98]
push dword [esi + 0xa4]
call eax
add esp, 0x14
test al, al
je 0x1012f19a
lea ecx, [ebp - 0x28]
call fcn.1004db90
jmp 0x1012f254
mov eax, dword [section..data]
test al, 4
je 0x1012f1d9
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x102b7d98
push 2
call fcn.10277e0a
add esp, 4
push eax
call fcn.1012fc30
push 2
call fcn.10277e0a
push eax
call fcn.102761ed
mov eax, dword [section..data]
add esp, 0x14
test al, 2
je 0x1012f218
sub esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov ecx, esp
cmovae eax, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.1013d1b0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x1012f209
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x40]
call fcn.1004a960
cmp dword [esi + 0xa4], 4
jne 0x1012f224
int3
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1012f254
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1012f24a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012f276
push edx
push ecx
call fcn.1026505f
add esp, 8
mov ecx, esi
call fcn.1005a840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
call fcn.10275373
int3