joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], ebp
cmp byte [edi], 0
je 0x512d2f
mov al, byte [edi]
cmp al, 0x25
jne 0x512cf1
mov al, byte [edi + 1]
add edi, 1
cmp al, 0x25
jne 0x512cab
cmp byte [esi], al
jne 0x512d34
add esi, 1
add edi, 1
jmp 0x512d26
cmp al, 0x30
jb 0x512ce8
cmp al, 0x39
ja 0x512ce8
movzx ebx, al
sub ebx, 0x30
add edi, 1
mov dword [esp + ebx*4 + 0x38], esi
cmp byte [esi], 0
je 0x512ce0
mov eax, dword [esp + 0x68]
push eax
lea ecx, [esi + ebp]
mov eax, edi
call fcn.00512650
test eax, eax
jne 0x512ce0
add ebp, 1
cmp byte [esi + ebp], al
jne 0x512cc5
mov dword [esp + ebx*4 + 0x10], ebp
add esi, ebp
jmp 0x512d24
test al, al
je 0x512d2f
add edi, 1
jmp 0x512d26
cmp dword [esp + 0x68], ebp
je 0x512d03
cmp byte [esi], al
jne 0x512d34
add esi, 1
add edi, 1
jmp 0x512d26
push esi
call fcn.005224d0
push edi
mov ebx, eax
call fcn.005224d0
mov ebp, eax
push ebp
push edi
push ebx
push esi
call fcn.00414480
test eax, eax
jne 0x512d34
add esi, ebx
add edi, ebp
xor ebp, ebp
cmp byte [edi], 0
jne 0x512c88
cmp byte [esi], 0
je 0x512d4d
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
push ecx
push edx
call fcn.00523cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
call fcn.00512700
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
Function at 0x519560
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push edi
mov edi, dword [esp + 0x2c]
push 0
push edi
call fcn.00516c50
mov eax, dword [esp + 0x30]
test eax, eax
je 0x519587
push eax
call fcn.004b7ab0
mov dword [edi + 0x28], 0
jmp 0x5195a5
mov eax, dword [0x58a724]
mov ecx, dword [0x58a72c]
push eax
push ecx
push 0x55065e
call fcn.004b7250
mov dword [edi + 0x28], 1
test eax, eax
mov dword [edi + 0x14], eax
je 0x5197b9
mov edx, dword [esp + 0x34]
push ebp
or eax, 0xffffffff
push esi
mov esi, dword [0x597e04]
mov dword [edi + 8], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x40]
push 0x7f00
push 0
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call esi
push eax
push 0
push 0
push 0x516ad0
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0
call fcn.004aa1e0
push 0x7f00
push 0
call esi
push eax
push 0
push 0
push 0x518290
push str.EVERYTHING_DROPDOWNLIST
push 0
call fcn.004aa1e0
mov ecx, dword [0x5981b0]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x86000000
push 0x55065e
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0x88
call fcn.004aa330
mov cl, byte [edi + 0x184]
push 0
mov dword [edi + 0xc], eax
mov edx, dword [0x5981b0]
mov eax, dword [edi + 0x60]
push edx
push 0
push eax
push 0
push 0
neg cl
push 0
push 0
push 0x86200000
push 0x55065e
push str.EVERYTHING_DROPDOWNLIST
sbb ecx, ecx
and ecx, 0x400000
or ecx, 0x88
push ecx
call fcn.004aa330
push edi
push eax
mov dword [edi + 0x10], eax
call fcn.004ac6f0
mov eax, edi
call fcn.00517b40
cmp dword [edi + 0x18], 0
je 0x5196ad
push edi
call fcn.004c5340
mov edx, dword [edi + 0xc]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push edx
call esi
mov eax, dword [edi + 0x10]
push 8
push eax
call esi
mov ecx, dword [edi + 0x68]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [edi + 0x10], 0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [edi], edx
mov dword [edi + 4], eax
je 0x51978d
mov ebp, dword [0x597e18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call ebp
test eax, eax
je 0x51977d
cmp dword [esp + 0x18], 0x12
je 0x5197af
lea esi, [esp + 0x14]
call fcn.00516d00
test eax, eax
jne 0x519794
cmp dword [esp + 0x18], 0x100
jne 0x519740
cmp dword [esp + 0x1c], 9
je 0x51979b
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [0x597de8]
test eax, eax
jle 0x5197a2
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00518770
test eax, eax
jne 0x519783
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [0x597dc4]
jmp 0x519783
call dword [sym.imp.USER32.dll_WaitMessage]
cmp dword [edi + 0x10], 0
jne 0x519704
push str.no_search_history_hwnd_n
jmp 0x5197a7
push str.outside_click_n
jmp 0x5197a7
push str.tab_out_n
jmp 0x5197a7
push str.no_getmsg_n
call fcn.0048f0d0
add esp, 4
push 0
push edi
call fcn.00516c50
pop esi
pop ebp
pop edi
add esp, 0x24
ret 0x10
Function at 0x525030
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push edi
push 1
push eax
xor edi, edi
call fcn.004a9a10
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5250dd
push esi
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.004ab7b0
test eax, eax
je 0x5250d5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, edx
or eax, ecx
je 0x5250c6
mov eax, edx
add eax, 1
adc ecx, edi
mov esi, eax
or esi, ecx
je 0x5250d5
test ecx, ecx
jg 0x5250d5
jl 0x525086
cmp eax, 0x80000000
jae 0x5250d5
mov esi, dword [esp + 0x18]
add edx, 1
push edx
push esi
call fcn.005233c0
test eax, eax
je 0x5250d5
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5250d5
mov eax, dword [esi]
cmp dword [esp + 0x1c], eax
jne 0x5250d5
mov ecx, dword [esi + 8]
mov byte [eax + ecx], 0
jmp 0x5250d0
mov edx, dword [esp + 0x18]
push edx
call fcn.00523df0
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret 8

Function at 0x529620
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x52965a
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x596280]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x529634
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x5296e2
sub ecx, ebx
je 0x5296c7
sub ecx, ebx
je 0x5296bb
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
Function at 0x549083
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x596fb8]
mov dword [ebp - 4], eax
mov eax, dword [0x58def0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x5490b2
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x54923f
push dword [0x596f20]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x54923f
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x5490ea
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x549102
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x549123
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x549140
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00548fe6
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x549163
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x549177
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00548fe6
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x5491ac
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x5491be
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.00548f17
test eax, eax
pop esi
jne 0x5491ff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.00548f17
test eax, eax
jne 0x54922d
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00548f17
test eax, eax
jne 0x54923f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00548f17
test eax, eax
je 0x54923f
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.00549750
leave
ret

Function at 0x549750
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x596fb8]
jne 0x54975a
repz ret
jmp fcn.0054a9ae
Function at 0x54cab0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5972f0]
je 0x54cacb
inc edi
cmp edi, 0x17
jb 0x54cabc
cmp edi, 0x17
jae 0x54cc4b
push ebp
push 3
call fcn.0054ed80
cmp eax, 1
pop ecx
je 0x54cc17
push 3
call fcn.0054ed80
test eax, eax
pop ecx
jne 0x54caff
cmp dword [0x596fc0], 1
je 0x54cc17
cmp ebx, 0xfc
je 0x54cc4a
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x598868
push ebp
call fcn.0054ed1b
add esp, 0xc
test eax, eax
je 0x54cb35
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push 0x104
mov esi, 0x598881
push esi
push 0
mov byte [0x598985], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x54cb79
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0054ed1b
add esp, 0xc
test eax, eax
je 0x54cb79
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0054bc35
add esp, 0x14
push esi
call fcn.0054ec90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x54cbbe
push esi
call fcn.0054ec90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x598b7c
push 0x56fb0c
sub ecx, eax
push ecx
push eax
call fcn.0054ebdb
add esp, 0x14
test eax, eax
je 0x54cbbe
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
jmp 0x54cbc0
xor esi, esi
push 0x587000
push ebx
push ebp
call fcn.0054eb6a
add esp, 0xc
test eax, eax
je 0x54cbe0
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push dword [edi*8 + 0x5972f4]
push ebx
push ebp
call fcn.0054eb6a
add esp, 0xc
test eax, eax
je 0x54cc02
push esi
push esi
push esi
push esi
push esi
call fcn.0054bc35
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0054e9ad
add esp, 0xc
jmp 0x54cc4a
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x54cc4a
cmp ebp, 0xffffffff
je 0x54cc4a
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5972f4]
push dword [esi]
call fcn.0054ec90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x8e0e74
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e0e7a
pop ebp
sub ebp, 6
sub ebp, 0x4e0e74
jmp 0x8e0ed8
dec edi
adc byte [si], bh
pop edi
mov al, byte [0x5f8109a]
and eax, 0x8c5b57d2
mov esi, 0x1eaf093
add byte [eax], al
add byte [edx + 0x6b], dh
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
xchg ecx, eax
cmp dword [edi + 0x2c], edi
jmp 0x8e0ee1
mov eax, 0x4e0e74
add eax, ebp
add eax, 0x93
mov ecx, 0x630
mov edx, 0xe00df347
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e0ef8
jmp 0x8e0f0b
sub eax, 0x57472f07
inc edi
inc edi
das
inc edi
mov ebp, dword [ebx + 0x47]
je 0x8e0ea0
pop ss
mov eax, 0x3167bd2
inc edi
pop ss
int3
Function at 0x40dbd9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40dc24
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0040ddfa
test al, al
jne 0x40dc1e
sub edx, 2
cmp edx, edi
jne 0x40dc04
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40dc46
lea eax, [edi + 2]
cmp edx, eax
je 0x40dc46
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040db25
add esp, 0x10
jmp 0x40dd40
push esi
lea ecx, [ebp - 0x255]
call fcn.0040ddfa
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40dc89
push dword [ebp - 0x25c]
jmp 0x40dc36
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40dcc6
cmp word [ebp - 0x226], 0
je 0x40dce7
cmp word [ebp - 0x226], ax
jne 0x40dcc6
cmp word [ebp - 0x224], 0
je 0x40dce7
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040db25
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x40dd33
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40dca0
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40dd1b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x40dd40
push 0x40d955
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.004108b0
add esp, 0x10
jmp 0x40dd10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407061
leave
ret

Function at 0x40eaaa
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4026ac
push 0x4026a4
push 0x4011ac
push 0x1e
call fcn.0040e9e7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40eade
push dword [ebp + 8]
mov ecx, esi
call dword [0x41814c]
call esi
jmp 0x40eae4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40eb28
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4026bc
push 0x4026b4
push 0x4011d0
push 0x20
call fcn.0040e9e7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40eb5f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41814c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x411c77
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx + 0x15672cee], al
sbb esi, dword [ebx]
lock xor dword [0x417952], edx
add ebx, 0x51d
Function at 0x411e07
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx - 0x6f20ee18], al
adc eax, 0x1c802b81
lodsb al, byte [esi]
xor edi, esp
Function at 0x4120af
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
add al, 0xf7
fcompi st(7)
rol byte [eax - 0x7d], 1
ljmp 0xfffb
Function at 0x100363d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f04d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1007807c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10039c75
mov edi, eax
add esp, 4
test edi, edi
je 0x1003646d
push 1
mov dword [ebp - 4], 0
call fcn.10038f0d
add esp, 4
mov dword [edi + 4], eax
jmp 0x1003646f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.100022b0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x100364ca
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x100364ca
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x100364e6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10036509
cmp byte [ebp + 0xc], 0
je 0x100364f5
push esi
call fcn.10039418
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10036515
mov esi, str.ios_base::badbit_set
jmp 0x10036525
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10036550
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10003b00
push 0x1007632c
lea eax, [ebp - 0x28]
push eax
call fcn.1003ad7c
int3

Function at 0x1004a009
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100658e8
push 0x100658e0
push str.FlsAlloc
push 0x1e
call fcn.10049ed3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004a03d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10060178]
call esi
jmp 0x1004a043
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1004a087
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100658f8
push 0x100658f0
push str.FlsGetValue
push 0x20
call fcn.10049ed3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1004a0be
push dword [ebp + 8]
mov ecx, esi
call dword [0x10060178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1004b768
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1004b5d9

Function at 0x1004bb62
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1003ab00
mov eax, dword [0x1007807c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1004a63c
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x1004bba4
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x1004bd00
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10059b80
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10079b18]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.1004cb59
mov ecx, dword [esi*4 + 0x10079b18]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x1004bcf9
cmp eax, dword [edi + ecx + 0x24]
jne 0x1004bcf9
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004bcf9
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004cb59
add esp, 0x14
test edx, edx
jl 0x1004bcf9
jg 0x1004bc6f
test eax, eax
jb 0x1004bcf9
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1004bcf9
jl 0x1004bc89
cmp dword [ebp - 0x1008], eax
ja 0x1004bcf9
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1004bca7
test ebx, ebx
je 0x1004bce0
cmp ecx, edi
jae 0x1004bce0
mov al, byte [ecx]
cmp al, 0xd
jne 0x1004bcc1
lea eax, [edi - 1]
cmp ecx, eax
jae 0x1004bccd
cmp byte [ecx + 1], 0xa
jne 0x1004bccd
inc ecx
jmp 0x1004bccd
movzx eax, al
movsx eax, byte [eax + 0x100782f8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1004bca7
cmp edx, ebx
jne 0x1004bca7
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x1004bcfe
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10039fdb
leave
ret