joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ed375
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101e6198]
jne 0x100ed37f
repz ret
jmp fcn.100f278c

Function at 0x10103ea6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100f20bb
and dword [ebp - 4], 0
cmp dword [0x101ec484], 0
mov ebx, eax
jne 0x10103f57
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10104008
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10145a7c
push edi
call esi
test eax, eax
je 0x10104008
push eax
call fcn.100f2049
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101ec484], eax
call esi
push eax
call fcn.100f2049
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101ec488], eax
call esi
push eax
call fcn.100f2049
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101ec48c], eax
call esi
push eax
call fcn.100f2049
pop ecx
mov dword [0x101ec494], eax
test eax, eax
je 0x10103f57
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100f2049
pop ecx
mov dword [0x101ec490], eax
mov eax, dword [0x101ec490]
cmp eax, ebx
je 0x10103faf
cmp dword [0x101ec494], ebx
je 0x10103faf
push eax
call fcn.100f20c4
push dword [0x101ec494]
mov esi, eax
call fcn.100f20c4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10103faf
test edi, edi
je 0x10103faf
call esi
test eax, eax
je 0x10103fa6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10103fa6
test byte [ebp - 0xc], 1
jne 0x10103faf
or dword [ebp + 0x10], 0x200000
jmp 0x10103fe8
mov eax, dword [0x101ec488]
cmp eax, ebx
je 0x10103fe8
push eax
call fcn.100f20c4
pop ecx
test eax, eax
je 0x10103fe8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10103fe8
mov eax, dword [0x101ec48c]
cmp eax, ebx
je 0x10103fe8
push eax
call fcn.100f20c4
pop ecx
test eax, eax
je 0x10103fe8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101ec484]
call fcn.100f20c4
pop ecx
test eax, eax
je 0x10104008
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1010400a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x66942aa
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x494520e3
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10004a00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10004a73
cmp ecx, eax
jne 0x10004a6b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10004a7b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10004a7b
cmp ecx, eax
jne 0x10004a7b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x14
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100c3eef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x10004ab0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x10004b23
cmp eax, edi
jne 0x10004b1b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10004b2b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10004b2b
cmp eax, edi
jne 0x10004b2b
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10004ed0
push 0x24
push edi
call fcn.100c3eef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10005410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10129fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x100f8bc4
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x200], 0xf
mov byte [ebp - 0x214], 0
call fcn.10007580
push 0x1f8
lea eax, [ebp - 0x1fc]
push 0
push eax
call fcn.100c6c10
cmp dword [ebp - 0x200], 0x10
lea eax, [ebp - 0x214]
push 0x1f3
cmovae eax, dword [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100cf780
mov edx, dword [ebp - 0x200]
add esp, 0x1c
cmp edx, 0x10
jb 0x100054c7
mov ecx, dword [ebp - 0x214]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100054bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000551f
push edx
push ecx
call fcn.100c3eef
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.10008450
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100d290c
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x101308a8
push 0x1f8
push eax
push dword [0x101292c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c3efd
mov esp, ebp
pop ebp
ret
call fcn.100cf1d9
int3
Function at 0x100055a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10129fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x101307d8]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10005606
mov dword [ebx + 0x10], 0
mov ecx, ebx
push 0
mov dword [ebx + 0x14], 0xf
push 0x100f8bc4
mov byte [ebx], 0
call fcn.10007580
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c3efd
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x100055d4
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call fcn.100c6110
add esp, 0xc
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
push dword [ebp - 0x20]
push esi
call fcn.10007580
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x10], 0
lea ecx, [ebp - 0x1c]
mov dword [ebx + 0x14], 0
movups xmmword [ebx], xmm0
mov byte [ebp - 0x1c], 0
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.10004d80
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c3efd
mov esp, ebp
pop ebp
ret
Function at 0x10005bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebf20
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x10129fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x440], esi
mov eax, dword [esi + 0x5f8]
test eax, eax
je 0x10005c43
push dword [esi]
push eax
push str._p____p
call fcn.10005410
add esp, 0xc
mov eax, dword [0x101307e0]
inc eax
mov dword [0x101307e0], eax
cmp eax, 0x9c4
jl 0x10005c69
push str.too_many_hooks:_cant_insert
call fcn.10005410
add esp, 4
xor al, al
jmp 0x10005e27
test edi, edi
je 0x10005c86
cmp byte [edi], 0
je 0x10005c86
push 0x3b
push edi
lea eax, [esi + 0x1d0]
push 0x3c
push eax
call fcn.100cf780
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0xa08
lea eax, [ebp - 0x28]
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10079410
mov ecx, eax
add esp, 0xa10
cmp dword [ecx + 0x14], 8
jb 0x10005cb5
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x440]
push ecx
push 0x1f4
lea eax, [esi + 0x20c]
push eax
mov dword [ebp - 0x43c], eax
call fcn.100cf2b5
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10004dd0
imul eax, dword [0x101307e0], 0xac8
sub esp, 0xa08
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
add eax, dword [0x101307dc]
mov ecx, eax
call fcn.10008a80
test al, al
jne 0x10005daf
mov edx, dword [ebp - 0x43c]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005d30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10007670
push 0xfde9
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10077e00
add esp, 0xc
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 1
jb 0x10005d71
mov eax, dword [eax]
push eax
push str.failed_to_insert_hook__s
call fcn.10005410
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10004d80
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10004dd0
imul ecx, dword [0x101307e0], 0xac8
add ecx, dword [0x101307dc]
call fcn.10008830
xor al, al
jmp 0x10005e27
mov eax, dword [ebp - 0x440]
lea ecx, [ebp - 0x428]
mov edx, ecx
mov dword [ebp - 0x438], 4
mov dword [ebp - 0x42c], 0
mov eax, dword [eax]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x43c]
sub eax, edx
mov dword [ebp - 0x43c], eax
nop word [eax + eax]
movzx eax, word [eax + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
test ax, ax
mov eax, dword [ebp - 0x43c]
jne 0x10005df0
push 0
push 0x101308a8
push 0x3f8
lea eax, [ebp - 0x438]
push eax
push dword [0x101292c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c3efd
mov esp, ebp
pop ebp
ret
Function at 0x10006200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
test eax, eax
je 0x1000621b
push eax
push str.removing_hook:__s
call fcn.10005410
add esp, 8
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push 0x101308a8
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [0x101292c8]
mov dword [ebp - 0x10], 3
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x10006ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x282
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
push edi
push 0
movups xmmword [edx], xmm0
push 0x101308a8
movups xmm0, xmmword [eax + 0x10]
mov eax, dword [ebp + 0x14]
lea edi, [edx + 0x20]
add eax, 0xa30
push eax
movups xmmword [edx + 0x10], xmm0
push edx
rep movsd dword es:[edi], dword [esi]
push dword [0x101292c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
ret

Function at 0x10007ba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
lea eax, [ecx*8]
mov ecx, dword [eax + edx]
add edx, 4
add eax, edx
mov edx, ecx
mov dword [ebp + 0xc], eax
nop
cmp edx, esi
jne 0x10007c08
mov eax, esi
jmp 0x10007c0c
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x10007c29
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x10007c1e
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
jmp 0x10007c00
pop edi
pop esi
mov dword [ebx], ecx
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10008100
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
mov esi, dword [edi + 0xc]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edi, [esi + ecx*8]
mov esi, eax
cmp esi, edx
jne 0x10008158
mov ecx, edx
jmp 0x1000815d
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1000817a
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x1000816c
mov eax, dword [eax]
jmp 0x10008150
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8
Function at 0x100081f0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec0e0
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x10129fe8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
sub eax, 0
je 0x100083fa
sub eax, 1
jne 0x1000841e
mov dword [0x101307d8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x12]
push eax
call fcn.100049c0
xor ecx, ecx
mov dword [ebp - 0x44], 0
mov word [ebp - 0x54], cx
add esp, 8
lea ecx, [ebp - 0x12]
mov dword [ebp - 0x40], 7
cmp eax, ecx
je 0x10008278
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.10007670
push 0x1013077c
sub esp, 0x18
mov dword [ebp - 4], 0
mov eax, esp
lea ecx, [ebp - 0x54]
push ecx
push str.LUNA_VNR_HOOKMAN_
push eax
call fcn.10003f90
add esp, 0xc
lea ecx, [ebp - 0x8c]
call fcn.10004c50
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0x101307e8
je 0x100082dc
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [0x101307e8]
mov byte [ebp - 4], 1
mov dword [0x101307e8], ecx
test eax, eax
je 0x100082dc
cmp eax, 0xffffffff
je 0x100082dc
push eax
call edx
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x8c]
mov byte [ebp - 4], 2
test eax, eax
je 0x100082f2
cmp eax, 0xffffffff
je 0x100082f2
push eax
call edx
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0xffffffff
call fcn.10004dd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10008315
xor eax, eax
jmp 0x10008423
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x694920
call fcn.100c3f0e
mov ebx, eax
add esp, 4
mov dword [ebp - 0x90], ebx
mov dword [ebp - 4], 3
test ebx, ebx
je 0x10008357
mov esi, ebx
mov edi, 0x9c4
mov ecx, esi
call fcn.10004c30
add esi, 0xac8
sub edi, 1
jne 0x10008343
jmp 0x10008359
xor ebx, ebx
push 0x101308a8
push 0x40
push 0x694920
push ebx
mov dword [ebp - 4], 0xffffffff
mov dword [0x101307dc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.10008190
push eax
lea eax, [ebp - 0x6c]
mov dword [ebp - 4], 4
push str.EMBED_SHARED_MEM
push eax
call fcn.10003f90
add esp, 0x14
push eax
push 0xa00
push 0x101307e4
push 0x101292d0
lea ecx, [ebp - 0x85]
mov byte [ebp - 4], 5
call fcn.100052e0
lea ecx, [ebp - 0x6c]
call fcn.10004dd0
lea ecx, [ebp - 0x84]
call fcn.10004dd0
call fcn.1007b050
push 0
push 0
push 0
push fcn.10006250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000841e
call fcn.1007b330
call fcn.10073990
push dword [0x101307dc]
call fcn.100c3f17
add esp, 4
push dword [0x101307e4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c3efd
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100086b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10008723
cmp ecx, eax
jne 0x1000871b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1000872b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1000872b
cmp ecx, eax
jne 0x1000872b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100c3eef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x10009ea0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10009f13
cmp ecx, eax
jne 0x10009f0b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10009f1b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10009f1b
cmp ecx, eax
jne 0x10009f1b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x18
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100c3eef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1000b0f0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10129fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1000b148
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1000b11f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x1000b11f
mov ecx, dword [eax + edi + 0x78]
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x1000b11f
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 4], ebx
cmp dword [ecx + edi + 0x18], esi
jbe 0x1000b1d0
mov eax, ecx
mov eax, dword [eax + edi + 0x24]
lea ecx, [edi + esi*2]
movzx ecx, word [ecx + eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [ebp - 0x10], eax
cmp ebx, edx
je 0x1000b1b0
mov dword [edx], eax
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x1000b1c3
lea eax, [ebp - 0x10]
push eax
push edx
lea ecx, [ebp - 0x1c]
call fcn.100099d0
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, dword [eax + edi + 0x18]
jb 0x1000b185
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
call fcn.10003ba0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret