joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fe90
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
sub esp, 0x20
push ebx
push edi
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
cmp dword [0x10046ef8], 1
jne 0x1000fec0
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x2c], 0
mov ecx, dword [esi + 0x1740]
push 0
je 0x1000ff4a
push 0x32
push 0x32
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 0x1800]
mov eax, dword [edx + 0x48]
lea ecx, [esi + 0x1800]
push 1
push 0x100361f4
call eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esi + 0x1818], eax
jmp 0x1000ff65
push 0x1a1
push 0x27b
push 0xfe
push 0x1c3
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [esi + 0x1938], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x49
je 0x1000ff80
mov edi, 0x4b
jmp 0x1000ff91
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 0
mov ecx, esi
call eax
push eax
call ebx
xor ecx, ecx
cmp dword [0x10046ef8], 1
jne 0x1000ff9f
or ecx, 0xffffffff
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
push edi
add eax, dword [esp + 0x28]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
add eax, dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x8c]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x8c]
push 1
mov ecx, esi
call eax
push eax
call ebx
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x10014180
Capabilities:
Accept command line arguments
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002f0d9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1004304c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov eax, dword [0x1004304c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0
push str._ShowDeskTop
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp eax, dword [ecx]
lea ecx, [esp + 8]
setne bl
mov dword [esp + 0x30], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x2c
ret

Function at 0x10014c30
Capabilities:
Create process on windows

Disassembly:
push edi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push 0
push 0
push esi
push 0x10036a88
push 0
call edi
cmp eax, 0x20
jg 0x10014c65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0
push esi
push str.iexplore
push 0x10036a88
push 0
call edi
pop edi
ret
Function at 0x10019260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
movzx esi, dx
push 0x10036d14
mov edi, eax
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
test ebp, ebp
jne 0x100192b5
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10019362
push 0x2000
push ebp
push ebp
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebx + 4], eax
xor eax, eax
mov esi, ebx
call fcn.10018c80
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100192d0
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebp
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
push ebp
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push esi
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x10]
push eax
push 1
xor esi, esi
push edi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1001935b
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1001935b
push eax
push ebx
call fcn.10018890
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
xor edi, edi
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
call fcn.10019170
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x1001b6c3
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
cmp dword [esi + 0xac], 0
jne 0x1001b6d8
xor al, al
pop esi
add esp, 0x20
ret 4
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi + 0xac]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
push 0x41
add eax, dword [esp + 0x24]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0xac]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0xac]
push ecx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xac]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov al, 1
pop esi
add esp, 0x20
ret 4

Function at 0x1001b7a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push edi
call edx
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1001b7d0
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 9
mov ecx, esi
call edx
push eax
call edi
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 5
mov ecx, esi
call edx
push eax
call edi
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
push 0x43
push 0
push 0
push 0
push 0
push 0
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
ret
Function at 0x10021f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x51c
mov eax, dword [0x1004304c]
xor eax, esp
mov dword [esp + 0x518], eax
push ebx
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], edi
cmp edi, ebx
jne 0x10021f6b
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
push esi
push 0x3ff
lea eax, [esp + 0x129]
push ebx
push eax
mov byte [esp + 0x130], bl
call sub.MSVCR90.dll_memset
push 0xfe
lea edx, [esp + 0x36]
xor ecx, ecx
push ebx
mov esi, 0x400
push edx
mov dword [esp + 0x28], esi
mov word [esp + 0x3c], cx
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x3c]
add esp, 0x18
lea ecx, [edi + 8]
test eax, eax
je 0x10021fde
cmp ecx, ebx
je 0x10021fde
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10021fc0
sub eax, esi
inc eax
push eax
lea edx, [esp + 0x28]
push edx
push eax
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x24]
push eax
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push 0xffffffffffffffff
shr esi, 1
push esi
mov esi, dword [sym.imp.MSVCR90.dll__snwprintf_s]
lea ecx, [esp + 0x134]
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x130]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10022040
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x518]
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
push 0x400
lea ecx, [esp + 0x128]
push ebx
push ecx
mov dword [esp + 0x20], ebx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.PnpInstanceID
push edx
call edi
test eax, eax
jne 0x10022138
lea ecx, [esp + 0x124]
push ecx
push 0x10037308
push 0xffffffffffffffff
lea edx, [esp + 0x28]
push 4
push edx
mov word [esp + 0x30], ax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
call esi
lea eax, [esp + 0x30]
push 4
push eax
call dword [sym.imp.MSVCR90.dll__wcslwr_s]
lea ecx, [esp + 0x38]
push 0x10037310
push ecx
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 0x24
test eax, eax
jne 0x10022138
call fcn.10021ed0
test al, al
je 0x100220e7
mov edx, dword [esp + 0x18]
cmp dword [edx + 0x1a0], 6
jmp 0x10022134
push 0x400
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push str.MediaSubType
push ecx
mov dword [esp + 0x28], 0x400
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
jne 0x10022138
cmp dword [esp + 0x124], 1
jne 0x10022138
mov bl, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x524]
pop esi
pop edi
mov al, bl
pop ebx
xor ecx, esp
call fcn.1002dfc6
add esp, 0x51c
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x173a678f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section._RDATA
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7b347a37
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1134040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127c27f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.01162470
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x11340e6
push eax
push esi
call fcn.01162827
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push 0x12959b4
call fcn.01161d4a
int3

Function at 0x1146460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127e3b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x11483b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127bfe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
cmp dword [ebp + 0xc], 1
mov edx, ecx
push ebx
sete al
mov dword [ebp - 0x10], edx
push esi
mov byte [edx + 0x48], al
lea ebx, [edx + 4]
mov eax, dword [ebp - 0x10]
lea esi, [edx + 8]
mov dword [edx + 0xc], ebx
lea ecx, [edx + 0x18]
mov dword [edx + 0x10], esi
mov byte [edx + 0x3d], 0
mov dword [edx + 0x20], ecx
push edi
lea edi, [edx + 0x14]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [edx + 0x1c], edi
add edx, 0x24
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 0xc]
mov dword [esi], 0
mov esi, dword [ebp + 8]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
test esi, esi
je 0x1148486
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push esi
call fcn.0117120a
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
jmp 0x1148489
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], esi
mov ecx, dword [0x12b98a4]
mov eax, dword [0x12b98a0]
pop edi
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword [edx + 0x40], eax
mov dword [edx + 0x38], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x11487f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127e65d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x128de68
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x128de70
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov byte [ecx + 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x114bc40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jbe 0x114bc5e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x114bc84
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x114bc70
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.011527e0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x114ca20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127f00d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp + 0xc]
je 0x114cc03
nop
cmp dword [edi + 0x14], 0xf
mov ebx, edi
jbe 0x114ca5a
mov ebx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x114ca78
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x114ca66
push esi
push edi
lea eax, [ebp - 0x20]
mov ecx, edx
push eax
call fcn.011527e0
cmp dword [ebp - 0x1c], 0
jne 0x114cbf4
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x7ffffff
je 0x114cc16
add eax, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x24], 0
call fcn.01163672
mov ebx, eax
add esp, 4
mov dword [ebp - 0x24], ebx
lea ecx, [ebx + 8]
push edi
call fcn.011463b0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0x1c]
inc ecx
mov dword [ebp + 8], eax
movss xmm3, dword [edx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x12a1450]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x12a1450]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x114cb9f
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.01186f50
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call 0x127be20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp + 8]
cmp eax, ecx
jae 0x114cb75
cmp eax, 0x200
jae 0x114cb73
shl eax, 3
cmp eax, ecx
jae 0x114cb75
mov eax, ecx
mov ecx, dword [ebp - 0x10]
push eax
call fcn.01157e70
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + 8]
push esi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.011527e0
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
jmp 0x114cba2
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov dword [eax], ebx
mov dword [ecx + 4], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ebp + 8], ecx
and eax, esi
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x24], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [edx + 4]
jne 0x114cbd4
mov dword [ecx + eax*8], ebx
jmp 0x114cbe7
cmp esi, dword [ebp + 8]
jne 0x114cbde
mov dword [ecx + eax*8], ebx
jmp 0x114cbeb
mov esi, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], esi
jne 0x114cbeb
mov dword [ecx + eax*8 + 4], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x114cbf7
mov edx, dword [ebp - 0x10]
add edi, 0x18
cmp edi, dword [ebp + 0xc]
jne 0x114ca50
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x129704c
call fcn.01161cea
int3
Function at 0x114ebb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x127f694
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 1
lea edi, [esi + 0x10]
mov dword [ebp + 8], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 2
mov dword [edi + 0xc], 0
mov byte [ebp - 4], 4
lea eax, [esi + 0x20]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 5
mov dword [eax + 0xc], 0
mov byte [ebp - 4], 7
lea ebx, [esi + 0x38]
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [ebp - 0x18], ebx
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x114ec75
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov byte [ebp - 4], 9
lea ecx, [esi + 0x70]
mov al, byte [ebp + 0xc]
mov byte [esi + 0x60], al
push 9
mov byte [esi + 0x68], 9
call fcn.01147ef0
mov byte [ebp - 4], 0xa
xor ebx, ebx
mov ecx, dword [edi + 0xc]
mov edx, dword [edi]
mov byte [ebp + 0xf], 1
mov dword [ebp - 0x1c], edx
test ecx, ecx
jns 0x114ecbf
mov eax, ecx
neg eax
cmp ebx, eax
jae 0x114ecbf
add ecx, ebx
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x114ecc9
add ecx, ebx
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
and ecx, 0x1f
lea eax, [ebp + 0xf]
push ecx
push edx
push eax
push 1
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.011516c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x114ed05
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x30