joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41df70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push eax
mov esi, ecx
call fcn.0041ddf0
cmp dword [ebp + 0xc], 0
je 0x41dfab
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41dfb7
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x41ee5d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x434fc4], 0
push esi
push edi
jne 0x41edce
call fcn.0041ed28
test eax, eax
je 0x41ee13
mov eax, dword [0x434fc4]
cmp eax, 1
jne 0x41edef
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41ee13
jmp 0x41ee55
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x41ee55
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41ee17
xor eax, eax
jmp 0x41ee55
mov eax, dword [esi]
push dword [0x434fc4]
call edi
mov edi, eax
test edi, edi
je 0x41ee39
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x41ee55
lea edi, [esi + 0xff0]
push esi
push dword [0x434fc4]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x41ee3f
mov eax, esi
pop edi
pop esi
ret
jmp 0x41edba

Function at 0x41f336
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4347f8]
jne 0x41f340
repz ret
jmp fcn.0041f9e0
Function at 0xf51946
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 2
jb 0xf51961
dec ah
cpuid
lea esp, [esp + 2]
jmp 0xf51a2c
Function at 0xf7738f
Capabilities:
Encrypt data using aes

Disassembly:
call 0xf54b1c
jmp 0xf54b63
jmp 0xf773df
jmp 0xf54cdb

Function at 0xf8f5e1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xf8fb13
bsr bx, sp
mov edi, dword [esp]
push edx
jmp 0xf8f633
jle 0xf54982
jg 0xf8f9d3
mov ch, 0x35
movsd dword es:[edi], dword [esi]
int3
mov byte [esp + 2], dl
lea esp, [esp + 4]
jmp 0xf8f5cb
mov ebx, dword [ebx*4 + 0xf5e990]
bsr edx, esp
lea edx, [edi*4]
jmp 0xf8f654
mov edx, esi
add edx, 0x11
movzx ebx, byte [edx]
pop edx
jmp 0xf8f612
mov edi, edx
jmp 0xf8f678
add esi, 0x10
inc dx
mov edx, dword [esi]
jmp 0xf8f63e
lea esp, [esp + 1]
and edi, ecx
sub esp, 5
lea esp, [esp + 1]
jmp 0xf8f6a1
shr edi, 0x18
mov edi, dword [edi*4 + 0xf5e990]
sub esp, 0x15
mov byte [esp + 0x10], ah
jmp 0xf8f65d
mov edi, dword [edi*4 + 0xf5ed90]
pushfd
call fcn.00f8f68b
lea esp, [esp + 0x20]
jmp 0xf549ae
mov ecx, dword [esp]
stc
dec ebx
shr cl, 1
mov ecx, 0xff
jmp 0xf8f6cf
lea ecx, [eax - 1]
bsf edx, esp
pushal
mov dword [ebp - 4], ecx
jmp 0xf8f723
pop edi
mov si, 0xf980
pop esi
call fcn.00f8fb65
pop eax
fisttp qword [ebp + 0x14]
out 0x62, eax
lodsb al, byte [esi]
mov esp, 0xbed636db
inc ebx
sal dword [esi + 0x3186b145], cl
xor bh, bh
dec ebp
cld
mov dword [esi + 0xc], edi
jne 0xf549ae
je 0xf54982
lea esp, [esp + 4]
pop ebx
leave
ret
Function at 0xf8f79f
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edx
jmp 0xf8f7bf
pop word [esp]
lea esp, [esp + 2]
jmp 0xf8f789
sub esp, 0xa
push dword [esp + 6]
mov byte [esp], dh
lea esp, [esp + 2]
jmp 0xf8f808
shr edi, 0x18
mov edi, dword [edi*4 + 0xf5e990]
and edi, ecx
jmp 0xf8f7a9
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
call fcn.00f8f7ec
lea esp, [esp + 1]
jmp 0xf8f859
movzx ebx, byte [edi]
pop edi
jmp 0xf8f93d
push edi
mov edi, esi
add edi, 6
jmp 0xf8f843
xor edi, dword [ebx*4 + 0xf5f190]
movzx ebx, byte [esi + 9]
call 0xf8f87b
and edx, ecx
clc
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0xf5f990]
jmp 0xf8f8f0
mov dx, word [esp]
mov dx, 0x8d9e
mov edx, dword [esi + 8]
call fcn.00f8f8da
lea edi, [0xca704b8d]
neg di
lea edi, [ebx + ebx]
jmp 0xf8f920
mov ebx, dword [ebx*4 + 0xf5e990]
bts edi, edi
jmp 0xf8f979
mov ebx, dword [ebx*4 + 0xf5e990]
and ebx, ecx
lea esp, [esp + 0x18]
jmp 0xf8f8a5
and edi, ecx
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
call 0xf8f960
insb byte es:[edi], dx
jmp 0xf8f9a3
mov ebx, dword [ebx*4 + 0xf5e990]
jmp 0xf8f987
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0xf5e990]
jmp 0xf8f94f
and ebx, ecx
xor edi, dword [ebx*4 + 0xf5f190]
jmp 0xf8f9b5
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0xf5f590]
movzx ebx, byte [esi + 0xa]
stc
jmp 0xf8f962
movzx ebx, byte [esi + 0xd]
and edx, ecx
sub esp, 0xc
mov dword [esp + 4], esi
jmp 0xf8fc67
add edx, 8
mov dword [edx], edi
pop edx
jmp 0xf8fa36
mov edx, dword [esi + 0xc]
push edx
mov edx, esi
jmp 0xf8f9e2
shr edi, 0x18
jmp 0xf8fa64
mov dword [esp], edx
cmc
popal
sub esp, 0xf
lea esp, [esp + 3]
jmp 0xf8fa00
mov ebx, dword [ebx*4 + 0xf5e990]
pushal
mov di, word [esp]
mov al, bl
jmp 0xf8fa16
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
jmp 0xf8fa8c
mov edi, dword [edi*4 + 0xf5e990]
and edi, ecx
sub esp, 9
lea esp, [esp + 1]
jmp 0xf8fa46
movzx ebx, byte [esi + 0xe]
sub esp, 0x10
jmp 0xf8fc32
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0xf5f590]
mov bx, sp
mov bh, 0x1b
jmp 0xf8fa76
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0xf5f990]
sub esp, 1
mov dx, 0x410
lea esp, [esp + 1]
jmp 0xf8f9f8
and ebx, ecx
cmc
clc
jmp 0xf8fb04
lea ebp, [ebp*4]
lea ebp, [ebp + 0xf5e990]
mov edx, dword [ebp]
pop ebp
jmp 0xf8fac5
xor edi, dword [edx*4 + 0xf5f990]
jmp 0xf8fb33
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0xf5f190]
and edx, ecx
jmp 0xf8faee
dec dword [ebp - 4]
and edx, ecx
cmc
push ebp
mov ebp, edx
jmp 0xf8fadb
mov ebx, dword [ebx*4 + 0xf5e990]
sub esp, 9
mov word [esp + 5], sp
lea esp, [esp + 1]
jmp 0xf8fbb0
mov dword [esp + 3], eax
mov edx, dword [edx*4 + 0xf5e990]
and edx, ecx
jmp 0xf8faaa
Function at 0xf8f7e0
Capabilities:
Encrypt data using aes

Disassembly:
bsr di, sp
dec di
jmp 0xf8f759
xor edi, dword [edx*4 + 0xf5f990]
mov edx, dword [esi + 4]
mov dword [esi], edi
bsr di, sp
jmp 0xf8f731
mov ebx, dword [ebx*4 + 0xf5e990]
bt di, dx
mov edi, 0x4104d007
call fcn.00f8f79f
cmc
je 0xf8f75b
popfd
nop
jmp 0x105ef857
lea edi, [esi + ebx*4 - 0x1b]
popal
int1
nop
arpl word [edi - 0x74659ce0], cx
adc al, 0x95
nop
jmp 0x22f1f87b
mov edx, dword [edx*4 + 0xf5e990]
stc
and edx, ecx
jmp 0xf8f747
lea esp, [esp + 1]
lea esp, [esp + 3]
and edx, ecx
jmp 0xf8f77d

Function at 0xf8f7ec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xf8f82c
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + 0xf5f590]
sub esp, 0x17
xchg bh, bl
push word [esp + 7]
jmp 0xf8f816

Function at 0xf8f87b
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 7]
lea esp, [esp + 1]
jmp 0xf8f6f7
push ecx
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xf8f6d8
mov ebx, dword [ebx*4 + 0xf5e990]
pushfd
push word [esp + 2]
clc
lea esp, [esp + 2]
jmp 0xf8f70a
and ebx, ecx
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0xf5f590]
movzx ebx, byte [esi + 2]
jmp 0xf8f6b8
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0xf5f190]
cmc
jmp 0xf8f872
movzx ebx, byte [esi + 5]
call fcn.00f8f7e0
and edx, ecx
stc
jmp 0xf8f884
mov edx, dword [edx*4 + 0xf5e990]
sub esp, 2
stc
call fcn.00f8f8d0
push ebx
xlatb
inc edi
and dl, cl
aas
retf

Function at 0xf8f8d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push dword [esp + 2]
lea esp, [esp + 2]
jmp 0xf8f8b5

Function at 0xf8f8da
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push eax
jmp 0xf8f916
mov eax, esi
add eax, 4
mov dword [eax], edi
pop eax
jmp 0xf8f900
Function at 0xf8f960
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, edx
jmp 0xf8f7bf
pop word [esp]
lea esp, [esp + 2]
jmp 0xf8f789
sub esp, 0xa
push dword [esp + 6]
mov byte [esp], dh
lea esp, [esp + 2]
jmp 0xf8f808
shr edi, 0x18
mov edi, dword [edi*4 + 0xf5e990]
and edi, ecx
jmp 0xf8f7a9
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
call fcn.00f8f7ec
lea esp, [esp + 1]
jmp 0xf8f859
movzx ebx, byte [edi]
pop edi
jmp 0xf8f93d
push edi
mov edi, esi
add edi, 6
jmp 0xf8f843
xor edi, dword [ebx*4 + 0xf5f190]
movzx ebx, byte [esi + 9]
call 0xf8f87b
and edx, ecx
clc
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0xf5f990]
jmp 0xf8f8f0
mov dx, word [esp]
mov dx, 0x8d9e
mov edx, dword [esi + 8]
call fcn.00f8f8da
lea edi, [0xca704b8d]
neg di
lea edi, [ebx + ebx]
jmp 0xf8f920
mov ebx, dword [ebx*4 + 0xf5e990]
bts edi, edi
jmp 0xf8f979
mov ebx, dword [ebx*4 + 0xf5e990]
and ebx, ecx
lea esp, [esp + 0x18]
jmp 0xf8f8a5
and edi, ecx
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
call 0xf8f960
insb byte es:[edi], dx
jmp 0xf8f9a3
mov ebx, dword [ebx*4 + 0xf5e990]
jmp 0xf8f987
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0xf5e990]
jmp 0xf8f94f
and ebx, ecx
xor edi, dword [ebx*4 + 0xf5f190]
jmp 0xf8f9b5
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0xf5f590]
movzx ebx, byte [esi + 0xa]
stc
jmp 0xf8f962
movzx ebx, byte [esi + 0xd]
and edx, ecx
sub esp, 0xc
mov dword [esp + 4], esi
jmp 0xf8fc67
add edx, 8
mov dword [edx], edi
pop edx
jmp 0xf8fa36
mov edx, dword [esi + 0xc]
push edx
mov edx, esi
jmp 0xf8f9e2
shr edi, 0x18
jmp 0xf8fa64
mov dword [esp], edx
cmc
popal
sub esp, 0xf
lea esp, [esp + 3]
jmp 0xf8fa00
mov ebx, dword [ebx*4 + 0xf5e990]
pushal
mov di, word [esp]
mov al, bl
jmp 0xf8fa16
mov edi, dword [edi*4 + 0xf5ed90]
and ebx, ecx
jmp 0xf8fa8c
mov edi, dword [edi*4 + 0xf5e990]
and edi, ecx
sub esp, 9
lea esp, [esp + 1]
jmp 0xf8fa46
movzx ebx, byte [esi + 0xe]
sub esp, 0x10
jmp 0xf8fc32
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + 0xf5f590]
mov bx, sp
mov bh, 0x1b
jmp 0xf8fa76
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0xf5f990]
sub esp, 1
mov dx, 0x410
lea esp, [esp + 1]
jmp 0xf8f9f8
and ebx, ecx
cmc
clc
jmp 0xf8fb04
lea ebp, [ebp*4]
lea ebp, [ebp + 0xf5e990]
mov edx, dword [ebp]
pop ebp
jmp 0xf8fac5
xor edi, dword [edx*4 + 0xf5f990]
jmp 0xf8fb33
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + 0xf5f190]
and edx, ecx
jmp 0xf8faee
dec dword [ebp - 4]
and edx, ecx
cmc
push ebp
mov ebp, edx
jmp 0xf8fadb
mov ebx, dword [ebx*4 + 0xf5e990]
sub esp, 9
mov word [esp + 5], sp
lea esp, [esp + 1]
jmp 0xf8fbb0
mov dword [esp + 3], eax
mov edx, dword [edx*4 + 0xf5e990]
and edx, ecx
jmp 0xf8faaa
Function at 0xf8fb7d
Capabilities:
Encrypt data using aes

Disassembly:
push edi
lea esp, [esp + 4]
push 4
jmp 0xf8fbf6
lea esp, [esp + 0x1c]
push 0xf60b44
jmp 0xf8fb88
pushal
pop dword [esp + 7]
mov dword [esp + 0x1c], esi
jmp 0xf8fb67
call fcn.00f6acc4
insd dword es:[edi], dx
sub esp, 0x14
mov word [esp + 0x10], bp
lea esp, [esp + 0x14]
jmp 0xf8fbe8
test eax, eax
je 0xf54b02
push edi
call fcn.00f8fbd1
push ebx
jmp 0xf8fc17
call esi
test eax, eax
call fcn.00f8fc4a
rcl byte [edi - 0x39]
mov byte [0xc84ebd51], al
pop esi
cmp eax, ecx
in eax, 0x14
xchg dword [esi], ebp
cmp dword [eax], ebx

Function at 0x10f4689
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Parse pe header

Disassembly:
mov dword [esp], ebp
push ecx
mov dword [esp], ebx
push edi
jmp 0x10f4673
Function at 0x403fa0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43dd1b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x44d100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x404170
lea eax, [ebp - 0x234]
push eax
push 4
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404170
mov eax, dword [ebp - 0x234]
mov ecx, 4
shr eax, 2
mul ecx
mov esi, eax
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.0042c3a4
mov edi, eax
add esp, 4
test edi, edi
je 0x404051
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x404053
xor edi, edi
mov dword [ebp - 0x240], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x234]
push edi
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404163
xor esi, esi
test dword [ebp - 0x234], 0xfffffffc
jbe 0x404163
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [edi + esi*4]
push ebx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402000
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 7
push 0
mov byte [ebp - 4], 1
lea ecx, [eax + eax]
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x238]
push eax
call fcn.00404bb0
mov ecx, dword [ebp - 0x238]
push 0
push 2
push 0x441620
call fcn.00404bb0
mov ecx, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x404151
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404147
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40418c
push ecx
push edx
call fcn.0042c396
add esp, 8
mov eax, dword [ebp - 0x234]
inc esi
shr eax, 2
cmp esi, eax
jb 0x404090
test edi, edi
je 0x404170
push edi
call fcn.0042c3ad
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c23e
mov esp, ebp
pop ebp
ret
call fcn.0042d4a0
int3
Function at 0x40b2d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e525
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44d100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00408c50
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40b363
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x40b4b1
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0042c366
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4438c0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4438c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x40b453
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0042c640
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x40b435
cmp ebx, 0x200
jae 0x40b433
shl ebx, 3
cmp ebx, ecx
jae 0x40b435
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.00414360
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408c50
mov edx, dword [eax]
jmp 0x40b456
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x40b481
mov dword [ecx + eax*8], esi
jmp 0x40b490
cmp edi, edx
jne 0x40b48a
mov dword [ecx + eax*8], esi
jmp 0x40b494
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40b494
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x443770
call fcn.0042a88a
int3
Function at 0x40f060
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43eb10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44d100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0042c366
mov edi, eax
add esp, 4
test edi, edi
je 0x40f10d
push 1
mov dword [ebp - 4], 0
call fcn.0042aaa8
add esp, 4
mov dword [edi + 4], eax
jmp 0x40f10f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.004031c0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x44dae8]
mov ecx, dword [0x44daec]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410040
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ed1d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x44d100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.00406e80
mov edi, eax
cmp edi, 0x44db30
je 0x4100d7
mov esi, dword [0x44db30]
mov ecx, 0x44db30
push dword [esi + 4]
push 0x44db30
call fcn.00408700
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov ecx, dword [0x44db30]
mov dword [0x44db34], 0
mov eax, dword [edi]
mov dword [0x44db30], eax
mov eax, dword [edi + 4]
mov dword [edi], ecx
mov ecx, dword [0x44db34]
mov dword [0x44db34], eax
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
mov ecx, eax
call fcn.00408700
push 0x40
push dword [ebp - 0x18]
call fcn.0042c396
add esp, 8
lea ecx, [ebp - 0x20]
push dword [ebp - 0x10]
call fcn.0040f1b0
mov cl, byte [0x44db20]
mov al, byte [ebp - 0x20]
mov edx, dword [0x44db28]
mov esi, dword [0x44db2c]
mov byte [ebp - 0x10], cl
mov byte [0x44db20], al
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x20], cl
mov ecx, dword [ebp - 0x14]
mov dword [0x44db28], eax
mov dword [0x44db2c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00415fa0
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
mov byte [ebp - 4], 0
cmova eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.Luna_Start
push edi
call esi
push str.Luna_EmbedSettings
push edi
mov dword [0x44db00], eax
call esi
push str.Luna_Inject
push edi
mov dword [0x44db08], eax
call esi
push str.Luna_useembed
push edi
mov dword [0x44db04], eax
call esi
push str.Luna_checkisusingembed
push edi
mov dword [0x44db0c], eax
call esi
push str.Luna_embedcallback
push edi
mov dword [0x44db10], eax
call esi
push 0
push 0x64
push 0
push 0
mov dword [0x44db14], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0x406a40
push 0x406a90
push fcn.004034b0
push fcn.004034b0
push fcn.004034b0
push fcn.004034b0
push 0x406a70
push 0x406a80
mov dword [0x44db18], eax
call dword [0x44db00]
mov ecx, dword [ebp + 0x1c]
add esp, 0x20
cmp ecx, 7
jbe 0x41022c
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410222
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410242
push ecx
push edx
call fcn.0042c396
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.0042d4a0
int3
Function at 0x411f20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
push esi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x44db40
xor eax, edx
imul esi, eax, 0x1000193
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00408c50
mov edx, dword [eax + 4]
test edx, edx
je 0x411fd2
mov ecx, dword [0x44db58]
mov eax, dword [0x44db4c]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x411fac
cmp eax, edx
jne 0x411fa4
mov eax, dword [0x44db44]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x411fb4
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x411fb4
cmp eax, edx
jne 0x411fb4
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [0x44db48]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.0042c396
add esp, 8
push 0
push 1
push dword [0x44db18]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop esi
mov esp, ebp
pop ebp
ret 4