joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b8e60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100b8fcf
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002c060
push 0x5c
push edi
call fcn.100bc53a
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b8f2d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100b8ee0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100b8fc5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100b8f41
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100b8f44
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100b8fc5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002c060
push 0x5c
push edi
call fcn.100bc53a
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100b8fd6
cmp esi, eax
jne 0x100b8f95
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100b8f50
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b97d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6d95
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100db040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100b9760
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100b985a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100b99a0
cmp dword [ebx + 8], 0xfffffff
jne 0x100b986e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100bc028
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d01f0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100d01f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100b9953
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100bd530
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100b9935
cmp eax, 0x200
jae 0x100b9933
shl eax, 3
cmp eax, ecx
jae 0x100b9935
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10081650
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100b9760
mov edx, dword [eax]
jmp 0x100b9956
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100b9981
mov dword [ecx + eax*8], esi
jmp 0x100b9993
cmp ebx, edx
jne 0x100b998a
mov dword [ecx + eax*8], esi
jmp 0x100b9997
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100b9997
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b9f60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6d95
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100db040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100b9760
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100b9fea
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100ba132
cmp dword [ebx + 8], 0xfffffff
jne 0x100b9ffe
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100bc028
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d01f0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100d01f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100ba0e5
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100bd530
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100ba0c7
cmp eax, 0x200
jae 0x100ba0c5
shl eax, 3
cmp eax, ecx
jae 0x100ba0c7
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10081650
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100b9760
mov edx, dword [eax]
jmp 0x100ba0e8
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100ba113
mov dword [ecx + eax*8], esi
jmp 0x100ba125
cmp ebx, edx
jne 0x100ba11c
mov dword [ecx + eax*8], esi
jmp 0x100ba129
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100ba129
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4096519f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xf772142
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404f50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5bbfb0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, edi
call dword [sym.imp.szutils.dll_public:_wchar_t_const____thiscall_TCommon::TString::operator_wchar_t_const__void_const]
push eax
push 0x200
lea edx, [ebp - 0x404]
push edx
push str.http:__cas1.szca.com_services_szcaCAValidate
push str.CertVerify
push 0x5ac5dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
mov ecx, esi
call dword [sym.imp.szutils.dll_public:_void___thiscall_TCommon::TString::constructor_wchar_t_const___int_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.00538458
mov esp, ebp
pop ebp
ret

Function at 0x404fe0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5bbfb0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, edi
call dword [sym.imp.szutils.dll_public:_wchar_t_const____thiscall_TCommon::TString::operator_wchar_t_const__void_const]
push eax
push 0x200
lea edx, [ebp - 0x404]
push edx
push str.77096DF368124074A8C2AC8C531D19C4
push 0x5ac554
push 0x5ac644
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
mov ecx, esi
call dword [sym.imp.szutils.dll_public:_void___thiscall_TCommon::TString::constructor_wchar_t_const___int_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.00538458
mov esp, ebp
pop ebp
ret

Function at 0x405070
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5bbfb0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov dword [ebp - 0x408], 0
mov word [ebp - 0x404], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov ecx, edi
call dword [sym.imp.szutils.dll_public:_wchar_t_const____thiscall_TCommon::TString::operator_wchar_t_const__void_const]
push eax
push 0x200
lea edx, [ebp - 0x404]
push edx
push str.1FCE57959FA24A31BAC475977A8EBCBE
push str.secertKey
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0xffffffffffffffff
lea eax, [ebp - 0x404]
push eax
mov ecx, esi
call dword [sym.imp.szutils.dll_public:_void___thiscall_TCommon::TString::constructor_wchar_t_const___int_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.00538458
mov esp, ebp
pop ebp
ret
Function at 0x405140
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e6b5
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
push esi
push edi
mov eax, dword [0x5bbfb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Ukey_Server_DEBD5D23_A29C_4AF9_ABEC_4608B9EEF36B
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xb8], eax
cmp eax, edi
je 0x4051b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4051b9
mov eax, dword [esi + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xb8], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call dword [sym.imp.mfc100u.dll_CWinApp::InitInstance]
push 0xc
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
cmp eax, edi
je 0x4051f8
mov ecx, eax
call dword [sym.imp.mfc100u.dll_CShellManager::CShellManager]
mov edi, eax
lea edx, [ebp - 0x104]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.004055f0
lea eax, [ebp - 0x104]
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [esi + 0x20], eax
call dword [sym.imp.mfc100u.dll_CDialog::DoModal]
test edi, edi
je 0x405232
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 1
mov ecx, edi
call eax
lea ecx, [ebp - 0x104]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.00405260
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c66a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5bbfb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [esi], ebx
push 8
mov dword [ebp - 4], ebx
call sub.mfc100u.dll_new
add esp, 4
cmp eax, ebx
je 0x419c55
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x18]
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], edi
mov dword [edi], ebx
push 8
mov byte [ebp - 4], 2
call sub.mfc100u.dll_new
add esp, 4
cmp eax, ebx
je 0x419c30
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x40], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov byte [esi + 0x30], bl
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov byte [esi + 0x7e], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x5b3644
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x5b3644
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x41c690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x41c6ab
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x41c6e2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x41c6de
jmp 0x41c6d0
cmp esi, eax
jae 0x41c6e2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x41c6d0
cmp esi, eax
jb 0x41c6e9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41cbe0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov al, byte [edx]
push esi
push edi
mov edi, ecx
mov esi, 0x811c9dc5
test al, al
je 0x41cc13
lea ecx, [eax - 0x41]
inc edx
cmp cl, 0x19
ja 0x41cc02
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x41cbf7
mov edx, dword [edi + 0x20]
mov eax, edx
and eax, esi
cmp dword [edi + 0x24], eax
pop edi
pop esi
ja 0x41cc2a
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x41cc30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
push esi
mov eax, edx
lea esi, [eax + 1]
push ebx
nop
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x41cc40
sub eax, esi
add eax, edx
mov esi, 0x811c9dc5
pop ebx
cmp edx, eax
je 0x41cc67
push edi
movsx edi, byte [edx]
imul esi, esi, 0x1000193
inc edx
xor esi, edi
cmp edx, eax
jne 0x41cc56
pop edi
mov edx, dword [ecx + 0x20]
mov eax, edx
and eax, esi
pop esi
cmp dword [ecx + 0x24], eax
ja 0x41cc7d
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4
Function at 0x41d930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 4]
cmp esi, dword [eax]
jne 0x41d95b
cmp dword [ebp + 0x10], eax
jne 0x41d95b
call fcn.0041d8c0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
pop ebp
ret 0xc
cmp esi, dword [ebp + 0x10]
je 0x41da49
push ebx
mov edx, dword [esi]
mov dword [ebp + 0xc], edx
mov ecx, dword [esi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41d972
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x41d996
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x41d986
mov ecx, dword [edi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [edi + 0x24], eax
ja 0x41d9ab
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [edi + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x41d9d4
cmp dword [ecx], esi
jne 0x41d9cc
mov edx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 0x10]
mov edx, dword [edi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x41d9dc
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x41d9dc
cmp dword [ecx], esi
jne 0x41d9dc
mov edx, dword [esi]
mov dword [ecx], edx
cmp esi, dword [edi + 4]
je 0x41da3a
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 0xc]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41da0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 8]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41da2e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call sub.mfc100u.dll_delete
add esp, 4
dec dword [edi + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
cmp esi, ecx
jne 0x41d965
pop ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 0xc
Function at 0x41e610
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53cc62
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5bbfb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp + 0xb]
mov dword [esi + 0x10], edx
push eax
lea edx, [ebp + 0xa]
xor edi, edi
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x38]
push edx
mov dword [esi], edi
mov dword [esi + 8], edi
call fcn.0041c5a0
lea eax, [ebp + 0xb]
push eax
lea edx, [ebp + 0xa]
lea ecx, [esi + 0x64]
push edx
mov dword [ebp - 4], edi
call fcn.0041c5a0
mov eax, dword [0x5bbfd8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5bbfd8
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 0x90], eax
mov eax, dword [0x5bbfd8]
mov edx, dword [eax + 0xc]
mov ecx, 0x5bbfd8
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff0001
add ecx, 0xffff
mov byte [ebp - 4], 3
mov word [esi + 0x98], cx
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
cmp eax, edi
je 0x41e718
push 0x20
call sub.mfc100u.dll_new__
add esp, 4
cmp eax, edi
je 0x41e73f
push fcn.0041e100
push 0x41b8d0
push 7
lea ebx, [eax + 4]
push 4
push ebx
mov dword [eax], 7
call fcn.0053872b
jmp 0x41e741
push 4
call sub.mfc100u.dll_new
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x41e73f
mov edx, dword [0x5bbfd8]
mov eax, dword [edx + 0xc]
mov ecx, 0x5bbfd8
call eax
add eax, 0x10
mov dword [ebx], eax
jmp 0x41e741
xor ebx, ebx
xor ecx, ecx
cmp dword [esi + 4], edi
lea edx, [esi + 0x18]
sete cl
mov dword [esi + 0x9c], ebx
push ecx
push edx
call fcn.00425a40
add esp, 8
mov dword [esi + 0x30], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc