joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a8e65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], ebx
cmp esi, edi
je 0x10019b09
movzx eax, byte [esi + 8]
lea edx, [esi + 8]
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], edx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x28]
push edx
push eax
call fcn.10018e80
cmp dword [ebp - 0x24], 0
jne 0x10019afc
cmp dword [ebx + 8], 0xfffffff
je 0x10019b1c
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
call fcn.10043d44
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], esi
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov cx, word [eax + 4]
mov word [esi + 0xc], cx
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101c04e0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101c04e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10019aa3
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.101880c0
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10178930
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10019a7c
cmp edi, 0x200
jae 0x10019a7a
shl edi, 3
cmp edi, ecx
jae 0x10019a7c
mov edi, ecx
push edi
mov ecx, ebx
call fcn.1001e810
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10018e80
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jmp 0x10019aa6
mov edx, dword [ebp - 0x28]
mov edi, dword [edx + 4]
inc dword [ebx + 8]
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [esi]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
jne 0x10019adb
mov dword [ecx + eax*8], esi
jmp 0x10019aeb
cmp dword [ecx + eax*8], edx
jne 0x10019ae5
mov dword [ecx + eax*8], esi
jmp 0x10019aef
cmp dword [ecx + eax*8 + 4], edi
jne 0x10019aef
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [esi]
mov dword [ebp + 8], esi
cmp esi, edi
jne 0x10019961
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10179b40
int3
Function at 0x1001a690
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101a8f70
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10043d44
mov edi, eax
add esp, 4
test edi, edi
je 0x1001a72c
push 1
mov dword [ebp - 4], 0
call fcn.1017b32d
add esp, 4
mov dword [edi + 4], eax
jmp 0x1001a72e
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1001ea70
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001ae00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a902f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1017afae
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1001ae8b
push eax
push esi
call fcn.1017b42b
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.10179b80
int3
Function at 0x1001e260
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101a951d
push eax
mov dword fs:[0], esp
sub esp, 0x824
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x1001e3f5
push 0x800
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.1017d200
add esp, 0xc
lea eax, [ebp - 0x830]
push 0x400
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x1001e3f5
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
lea esi, [ebp - 0x830]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001e2e0
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x1001e419
cmp esi, 7
ja 0x1001e329
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x830]
add esi, esi
mov dword [ebp - 0x18], 7
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1017caa0
add esp, 0xc
xor eax, eax
mov word [ebp + esi - 0x2c], ax
jmp 0x1001e37f
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x1001e33c
mov eax, SysReAllocString
jmp 0x1001e346
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10016ca0
mov ecx, dword [ebp - 0x14]
mov edi, eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x830]
add esi, esi
mov dword [ebp - 0x2c], edi
push esi
push eax
push edi
mov dword [ebp - 0x18], ecx
call fcn.1017caa0
add esp, 0x14
xor eax, eax
mov word [esi + edi], ax
pop edi
cmp dword [ebp - 0x18], 7
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xd]
cmova edx, dword [ebp - 0x2c]
mov esi, dword [ebp + 8]
push ecx
mov ecx, esi
mov dword [ebp - 4], 0
lea eax, [edx + eax*2]
lea edx, [ebp - 0x2c]
cmova edx, dword [ebp - 0x2c]
push eax
push edx
call fcn.100171d0
mov ecx, dword [ebp - 0x18]
cmp ecx, 7
jbe 0x1001e408
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e3da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e41e
push ecx
push edx
call fcn.1017821e
add esp, 8
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.10024c50
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.100093c0
call fcn.1018070f
int3
Function at 0x1001e810
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1001e95a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1001dcf0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1001e92d
movzx edx, byte [eax + 8]
mov ecx, dword [ecx]
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x1001e8ae
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1001e923
mov edx, dword [edx + 4]
movzx ebx, word [eax + 8]
cmp bx, word [edx + 8]
jne 0x1001e8ea
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1001e8e2
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1001e920
cmp edi, edx
je 0x1001e8fd
nop
mov edx, dword [edx + 4]
cmp bx, word [edx + 8]
je 0x1001e936
cmp edi, edx
jne 0x1001e8f0
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x1001e872
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1001e920
push 0x101c0110
call fcn.10179b40
int3

Function at 0x100210a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
imul eax, edx, 0x1000193
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.10018e80
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x100210e0
add eax, 0xa
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.10179b60
int3
Function at 0x10022b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101a99ed
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10043d44
mov edi, eax
add esp, 4
test edi, edi
je 0x10022ba2
push 1
mov dword [ebp - 4], 0
call fcn.1017b32d
add esp, 4
mov dword [edi + 4], eax
jmp 0x10022ba4
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
push ebx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1001a060
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10022c00
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10022c00
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
pop ebx
jne 0x10022c1d
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10022c3e
cmp byte [ebp + 0xc], 0
je 0x10022c2c
push esi
call fcn.1017b836
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10022c4a
mov esi, str.ios_base::badbit_set
jmp 0x10022c5a
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10022d90
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.1001b070
push 0x10204398
lea eax, [ebp - 0x28]
push eax
call fcn.1017c67f
int3
Function at 0x10025900
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
lea eax, [ebp - 0x224]
push 0x208
push 0
push eax
call fcn.1017d200
add esp, 0xc
lea eax, [ebp - 0x224]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xorps xmm0, xmm0
test eax, eax
je 0x1002599f
lea eax, [ebp - 0x224]
mov dword [ebp - 0xc], 0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10025954
sub eax, edx
lea ecx, [ebp - 0x1c]
sar eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10016d00
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x1c]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + 0x10], xmm0
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0x101c0044
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.10016d00
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030040
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa74e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x10], edi
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], vtable.CMD_MAP.0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
movups xmmword [edi + 0x34], xmm0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0xf
mov byte [edi + 0x4c], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x12]
mov dword [ebp - 0x18], 0x2d3d3d2d
mov word [ebp - 0x14], 0x3e7c
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
sub eax, ecx
je 0x10030126
push eax
lea ecx, [edi + 0x64]
call fcn.100158e0
mov esi, dword [edi + 0x64]
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x12]
sub eax, ecx
push eax
mov dword [ebp - 0x10], eax
mov eax, ecx
push eax
push esi
call fcn.1017caa0
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, esi
mov dword [edi + 0x68], eax
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10030b80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aa74e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x10], edi
movups xmmword [edi + 4], xmm0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [edi], vtable.REC_MAP.0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
movups xmmword [edi + 0x34], xmm0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0xf
mov byte [edi + 0x4c], 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
lea eax, [ebp - 0x12]
mov dword [ebp - 0x18], 0x2d3d3d2d
mov word [ebp - 0x14], 0x3e7c
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
sub eax, ecx
je 0x10030c66
push eax
lea ecx, [edi + 0x64]
call fcn.100158e0
mov esi, dword [edi + 0x64]
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x12]
sub eax, ecx
push eax
mov dword [ebp - 0x10], eax
mov eax, ecx
push eax
push esi
call fcn.1017caa0
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, esi
mov dword [edi + 0x68], eax
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003fe10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
mov dword [ebp - 8], eax
add eax, 0x18
cmp dword [edx + 0x14], 0xf
mov ebx, dword [edx + 0x10]
push edi
mov dword [ebp - 4], eax
mov edi, edx
jbe 0x1003fe34
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x1003fe54
nop
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1003fe40
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.10018d90
pop edi
pop esi
pop ebx
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003fe71
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx + 0x1c]
je 0x1003fe82
mov eax, dword [eax + 0x20]
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10042660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100426bd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10042680
mov eax, dword [esi]
jmp 0x1004279b
cmp eax, 0x4e0
jb 0x1004279b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100426d6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10042721
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10042980
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101abc4d
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
cmp dword [esi + 0x10], 0
jne 0x100429d1
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x14], 0xf
mov eax, esi
mov dword [ebp - 0x10], 0
jbe 0x100429e2
mov eax, dword [esi]
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push 0
push 1
push 0
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10042afc
mov ebx, dword [ebp - 0x10]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], eax
mov dword [ebp + 0xc], eax
test ebx, ebx
je 0x10042a87
cmp ebx, 0x7fffffff
ja 0x10042b17
cmp ebx, 0x1000
jb 0x10042a54
lea eax, [ebx + 0x23]
cmp eax, ebx
jbe 0x10042b1c
push eax
call fcn.10043d44
add esp, 4
test eax, eax
je 0x10042b21
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x10042a5f
push ebx
call fcn.10043d44
add esp, 4
mov edi, eax
push ebx
lea eax, [ebx + edi]
mov dword [ebp - 0x24], edi
push 0
push edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], eax
call fcn.1017d200
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x14], edi
mov dword [ebp + 0xc], ebx
jmp 0x10042a89
xor ebx, ebx
cmp dword [esi + 0x14], 0xf
mov dword [ebp - 4], 0
jbe 0x10042a98
mov esi, dword [esi]
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
push 1
push 0
push esi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10042b26
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp - 0x14]
sub eax, ecx
mov esi, dword [ebp - 0x10]
cmp esi, eax
jae 0x10042ac6
lea ebx, [ecx + esi]
jmp 0x10042adb
jbe 0x10042adb
lea eax, [ebp + 0xf]
push eax
push esi
lea ecx, [ebp - 0x24]
call fcn.10042580
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], edi
pop edi
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push 0x101c03d4
lea ecx, [ebp - 0x24]
call fcn.1000b8d0
push 0x10201c84
lea eax, [ebp - 0x24]
push eax
call fcn.1017c67f
call fcn.100093d0
call fcn.100093a0
call fcn.1018070f
push 0x101c04cc
lea ecx, [ebp - 0x30]
call fcn.1000b8d0
push 0x10201c84
lea eax, [ebp - 0x30]
push eax
call fcn.1017c67f
int3
Function at 0x10042ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1388
call fcn.10178900
call fcn.1017be29
mov dword [ebp - 4], 0xffffffff
mov ecx, 1
mov dword [ebp - 0x1384], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ebp + ecx*4 - 0x1384], eax
inc ecx
cmp ecx, 0x270
jb 0x10042cc4
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1388]
push esi
mov esi, dword [ebp + 8]
xor eax, 0x80000000
xor esi, 0x80000000
mov dword [ebp - 0x1388], 0x270
sub eax, esi
cmp eax, 0xffffffff
jne 0x10042d22
call fcn.10042660
mov ecx, eax
lea eax, [esi + ecx]
xor eax, 0x80000000
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
lea edi, [eax + 1]
call fcn.10042660
mul edi
mov dword [ebp + 8], eax
mov ecx, edx
cmp eax, edi
jae 0x10042d64
mov eax, edi
xor edx, edx
neg eax
div edi
push ebx
mov ebx, edx
cmp dword [ebp + 8], ebx
jae 0x10042d63
nop word [eax + eax]
lea ecx, [ebp - 0x1388]
call fcn.10042660
mul edi
mov ecx, edx
cmp eax, ebx
jb 0x10042d50
pop ebx
lea eax, [esi + ecx]
pop edi
xor eax, 0x80000000
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100437e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101abd0d
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x1004387e
cmp byte [ebp + 8], 0
mov eax, dword [esi + 0xc]
mov byte [esi + 8], 1
mov dword [esi + 0x10], eax
je 0x10043879
push 8
call fcn.10043d44
add esp, 4
test eax, eax
je 0x1004382d
mov dword [eax], esi
mov dword [eax + 4], fcn.10043900
jmp 0x1004382f
xor eax, eax
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10043770
push 0
push 0
call fcn.101866a5
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x10043894
cmp dword [esi + 4], 0
jne 0x1004388f
mov eax, dword [ebp - 0x10]
mov dword [esi], ecx
mov dword [esi + 4], eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.10043900
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.1018673e
push 6
mov dword [ebp - 0x10], 0
call fcn.1017ac82
int3