joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403090
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x7d0
je 0x4030b7
cmp dword [ebp - 4], 0x7d1
je 0x40317b
jmp 0x4031bd
cmp dword [0x4145d4], 0
je 0x403115
push 0xffffffffffffffff
mov ecx, dword [0x4133ec]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
mov edx, dword [0x4133e0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x4133e0], 0
push 0
push 1
mov eax, dword [0x4133ec]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [0x4145d4], 0
call fcn.00405aa0
push 0
push 0x71
call fcn.00406dd0
add esp, 8
jmp 0x403179
push 0xffffffffffffffff
mov ecx, dword [0x4133e8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x103
push 0x4141a0
push 0x3e8
mov edx, dword [0x4132dc]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.SQLUNIRL.dll__GetWindowText_12]
push 0
push 1
mov eax, dword [0x4133e8]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0
push 0x75
call fcn.00406dd0
add esp, 8
push 0
push 0x413040
mov ecx, dword [0x4132dc]
push ecx
call fcn.00408c20
add esp, 0xc
jmp 0x4031bd
cmp dword [0x4145d0], 0
jne 0x4031bd
mov dword [0x4145d0], 1
push 0
push 0x401980
mov edx, dword [0x4132dc]
push edx
push 0x6b
call dword [sym.imp.SQLUNIRL.dll__MAKEINTRESOURCE_4]
push eax
mov eax, dword [0x4133f8]
push eax
call fcn.00402230
add esp, 0x14
mov dword [0x4145d0], 0
mov esp, ebp
pop ebp
ret
Function at 0x4037f0
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [0x413030]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov ecx, dword [0x4133e4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4145d4], 0
je 0x40382e
push 1
mov edx, dword [0x4133e0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x4113b8], 0xffffffff
je 0x403872
push 0x1d4c0
mov eax, dword [0x4113b8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40385b
push 1
mov ecx, dword [0x4113b8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x4113b8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4113b8], 0xffffffff
cmp dword [0x4113bc], 0xffffffff
je 0x4038b6
push 0x1d4c0
mov eax, dword [0x4113bc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40389f
push 1
mov ecx, dword [0x4113bc]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [0x4113bc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4113bc], 0xffffffff
mov eax, dword [0x4133f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4133f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x4133ec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4133e8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4133e4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4132b8
call fcn.0040b620
add esp, 4
push 0x413040
call fcn.004098e0
add esp, 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov esp, ebp
pop ebp
ret
Function at 0x4099c0
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.0040cd20
mov eax, dword [0x412860]
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x1018], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1016]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x808], 0
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x806]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x411e80
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4bc]
test eax, eax
jne 0x409a48
push 0x411e98
mov edx, dword [0x4132dc]
push edx
call fcn.0040c2a0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 1
jmp 0x409ba9
push 0x411eb0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x411ec0
mov edx, dword [ebp + 8]
push edx
call sub.MSVCR71.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x409af2
mov word [ebp - 0x1118], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x1116]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.MSSQL_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2]
push edx
lea eax, [ebp - 0x1118]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4c0]
lea edx, [ebp - 0x1118]
push edx
push 0x411ee0
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x4cc]
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
mov eax, dword [0x4132dc]
push eax
call fcn.0040c2a0
add esp, 8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, 1
jmp 0x409ba9
push 0x411f10
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4bc]
test eax, eax
jne 0x409ba0
lea ecx, [ebp - 0x810]
push ecx
push 0x20019
push 0
push 0x411f20
push 0x80000002
mov edx, dword [0x41301c]
call dword [edx + 0x3d4]
test eax, eax
jne 0x409b95
mov dword [ebp - 0x80c], 0x7ff
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0x1018]
push ecx
lea edx, [ebp - 0x814]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x810]
push ecx
mov edx, dword [0x41301c]
call dword [edx + 0x3e4]
test eax, eax
jne 0x409b7d
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x409b86
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409b9e
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x409ba4
xor eax, eax
jmp 0x409ba9
mov eax, 1
mov ecx, dword [ebp - 4]
call fcn.0040cd05
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40c2a0
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x412860]
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x46c], 0
lea eax, [ebp - 0x470]
push eax
push 0x18
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c30d
lea edx, [ebp - 0x470]
push edx
push 7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c30d
xor eax, eax
jmp 0x40c3d0
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x470]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x478]
test eax, eax
je 0x40c3ca
push 0x412840
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4b4]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4b4]
push 0x412844
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [0x41301c]
call dword [edx + 0x4b4]
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [0x41301c]
call dword [edx + 0x170]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x40c3ca
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 4]
call fcn.0040cd05
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40c3f0
Capabilities:
Delete file
Get common file path
Get startup folder

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x412860]
mov dword [ebp - 4], eax
push edi
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x48c]
push eax
push 0x18
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c451
lea edx, [ebp - 0x48c]
push edx
push 7
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c451
jmp 0x40c5a3
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x48c]
push eax
mov ecx, dword [0x41301c]
call dword [ecx + 0x478]
test eax, eax
je 0x40c5a3
push 0x412850
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4b4]
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x4b4]
push 0x412854
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [0x41301c]
call dword [edx + 0x4b4]
push 0x1e
push 0
lea eax, [ebp - 0x230]
push eax
call sub.MSVCR71.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x488]
push ecx
lea edx, [ebp - 0x210]
push edx
mov eax, dword [0x41301c]
call dword [eax + 0x170]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
je 0x40c5a3
mov byte [ebp - 0x598], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x597]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp + eax*2 - 0x210], 0
push 0
push 0
push 0x104
lea eax, [ebp - 0x598]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 3
lea edx, [ebp - 0x598]
mov dword [ebp - 0x228], edx
mov word [ebp - 0x220], 0x14
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [ebp - 4]
call fcn.0040cd05
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40cac0
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x40ec30
call fcn.0040cff4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40cb00
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40cb00
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40cb18
cmp eax, 0x20b
je 0x40cb05
mov dword [ebp - 0x1c], ebx
jmp 0x40cb2c
cmp dword [ecx + 0x84], 0xe
jbe 0x40cb00
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40cb26
cmp dword [ecx + 0x74], 0xe
jbe 0x40cb00
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4145e8], 0xffffffff
or dword [0x4145ec], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x412984]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x412980]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4145e4], eax
call fcn.0040ceff
call fcn.0040cfc7
cmp dword [0x412870], ebx
jne 0x40cb8c
push 0x40cfbf
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040cf9d
push 0x411010
push 0x41100c
call sub.MSVCR71.dll__initterm
push 0x40cf48
call fcn.0040cee8
mov eax, dword [0x41297c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x412978]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40cbe0
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x411008
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40cc5e
cmp al, bl
je 0x40cc0a
cmp dword [ebp - 0x20], ebx
jne 0x40cc5e
mov al, byte [esi]
cmp al, bl
je 0x40cc1a
cmp al, 0x20
ja 0x40cc1a
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40cc0a
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x40cc36
movzx eax, word [ebp - 0x54]
jmp 0x40cc39
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004027e0
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40cc56
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40ccb3
cmp al, 0x22
jne 0x40cc6d
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40cc80
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x40cbf8
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040d02f
ret
Function at 0x10001310
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x1001b890]
mov ecx, dword [0x1001b894]
lea edx, [eax - 1]
imul edx, eax
test dl, 1
sete byte [ebp - 0xd]
cmp ecx, 0xa
setl byte [ebp - 0xe]
mov eax, 0x5e1f7532
jmp 0x10001370
mov eax, dword [0x1001b890]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8fa59cce
mov ecx, 0x7ba77c67
cmove eax, ecx
cmp dword [0x1001b894], 0xa
cmovl eax, ecx
nop word cs:[eax + eax]
nop
cmp eax, 0x5e1f7531
jle 0x10001390
cmp eax, 0x7a192810
jg 0x100013b0
cmp eax, 0x5e1f7532
je 0x100013db
cmp eax, 0x6d2eb977
jne 0x10001370
jmp 0x1000133f
cmp eax, 0x8fa59cce
je 0x100013fa
cmp eax, 0xed6ba0f
je 0x100014ad
cmp eax, 0x124ba212
jne 0x10001370
jmp 0x10001569
cmp eax, 0x7a192811
je 0x10001404
cmp eax, 0x7ba77c67
jne 0x10001370
mov eax, dword [0x1001b890]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a192811
mov ecx, 0xed6ba0f
jmp 0x10001357
movzx ecx, byte [ebp - 0xd]
cmp byte [ebp - 0xe], 0
mov eax, 0x8fa59cce
mov edx, 0x6d2eb977
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x10001370
mov eax, 0x6d2eb977
jmp 0x10001370
push eax
sub esp, 0xc
mov eax, esp
sub esp, 0x10
mov edi, esp
sub esp, 0xc
mov ebx, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], ecx
mov byte [eax + 0xc], 0
mov dword [eax + 8], 0x4c4c442e
mov dword [eax + 4], 0x32334c45
mov dword [eax], 0x4e52454b
mov byte [edi + 0xc], 0
mov dword [edi + 8], 0x636f6c6c
mov dword [edi + 4], 0x416c6175
mov dword [edi], 0x74726956
mov dword [ebx + 8], 0x57656c
mov dword [ebx + 4], 0x69466574
mov dword [ebx], 0x61657243
movsd xmm0, qword [0x10015036]
movsd qword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x10015026]
movups xmmword [ecx], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [0x1001b870], eax
push ebx
push esi
call edi
mov dword [0x1001b874], eax
push dword [ebp - 0x14]
push esi
call edi
mov dword [0x1001b87c], eax
mov eax, 0xed6ba0f
jmp 0x10001370
push eax
sub esp, 0xc
mov eax, esp
sub esp, 0x10
mov edi, esp
sub esp, 0xc
mov ebx, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x14], ecx
mov byte [eax + 0xc], 0
mov dword [eax + 8], 0x4c4c442e
mov dword [eax + 4], 0x32334c45
mov dword [eax], 0x4e52454b
mov byte [edi + 0xc], 0
mov dword [edi + 8], 0x636f6c6c
mov dword [edi + 4], 0x416c6175
mov dword [edi], 0x74726956
mov dword [ebx + 8], 0x57656c
mov dword [ebx + 4], 0x69466574
mov dword [ebx], 0x61657243
movsd xmm0, qword [0x10015036]
movsd qword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x10015026]
movups xmmword [ecx], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push edi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [0x1001b870], eax
push ebx
push esi
call edi
mov dword [0x1001b874], eax
push dword [ebp - 0x14]
push esi
call edi
mov dword [0x1001b87c], eax
mov eax, dword [0x1001b890]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a192811
mov ecx, 0x124ba212
jmp 0x10001357
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000bcb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov ecx, dword [0x102bd158]
call fcn.100090e0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x102bd160]
call fcn.10008f20
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000bcee
mov ecx, dword [ebp - 8]
call fcn.10008fa0
mov ecx, dword [eax]
and ecx, 1
jne 0x1000bcf3
jmp 0x1000be84
mov ecx, dword [ebp - 8]
call fcn.10008e90
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1000bd09
jmp 0x1000be84
mov ecx, dword [0x102bd158]
call fcn.10009140
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000bd26
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x2c], 0
je 0x1000bd2b
jmp 0x1000be84
cmp dword [0x10288ab0], 0xffffffff
je 0x1000bd4c
mov eax, dword [0x10288ab0]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
je 0x1000bd4c
jmp 0x1000be84
call fcn.1009ba70
fstp dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
movss xmm0, dword [edx + 0xec]
comiss xmm0, dword [0x100e6fc4]
jbe 0x1000bd98
movzx eax, byte [0x101e0b1d]
test eax, eax
jne 0x1000bd98
cvtss2sd xmm0, dword [ebp - 0xc]
addsd xmm0, qword [0x100e6fa0]
cvtsd2ss xmm0, xmm0
mov ecx, dword [ebp - 4]
movss dword [ecx], xmm0
mov edx, dword [ebp - 4]
movss xmm0, dword [ebp - 0xc]
movss dword [edx + 4], xmm0
mov ecx, dword [ebp - 8]
call fcn.1000f950
movss xmm0, dword [0x102714cc]
ucomiss xmm0, dword [eax]
lahf
test ah, 0x44
jnp 0x1000be58
mov ecx, dword [ebp - 8]
call fcn.1000f950
movss xmm0, dword [eax]
movss dword [0x102714cc], xmm0
mov eax, dword [ebp - 4]
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [eax + 4]
push ecx
movss dword [esp], xmm0
call fcn.1000a750
add esp, 4
fstp qword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x24]
comisd xmm0, xmmword [0x100e6fa8]
jbe 0x1000be58
mov ecx, dword [ebp - 8]
call fcn.1000f950
mov ecx, dword [ebp - 4]
movss xmm0, dword [eax]
subss xmm0, dword [ecx + 8]
push ecx
movss dword [esp], xmm0
call fcn.10009760
fstp dword [esp]
call fcn.1000a750
add esp, 4
fstp dword [ebp - 0x1c]
movss xmm0, dword [ebp - 0x1c]
comiss xmm0, dword [0x100e6fe0]
jbe 0x1000be58
cvtss2sd xmm0, dword [ebp - 0xc]
addsd xmm0, qword [0x100e6fb0]
mov edx, dword [0x102bd164]
cvtss2sd xmm1, dword [edx + 0x20]
addsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 4]
movss dword [eax], xmm0
mov ecx, dword [ebp - 4]
movss xmm0, dword [ebp - 0xc]
comiss xmm0, dword [ecx]
jbe 0x1000be84
cvtss2sd xmm0, dword [ebp - 0xc]
addsd xmm0, qword [0x100e6fb0]
cvtsd2ss xmm0, xmm0
mov edx, dword [ebp - 4]
movss dword [edx], xmm0
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 1
mov esp, ebp
pop ebp
ret
Function at 0x1001b1d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1001b1ef
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1001b21f
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.1001b1d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10029420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x101dccd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x10029447
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1002944e
mov al, 1
jmp 0x10029532
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x40], edx
call fcn.100102a0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x2c]
call dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
call fcn.100102a0
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.1002a700
add esp, 8
movzx eax, al
test eax, eax
je 0x10029494
xor al, al
jmp 0x10029532
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x4c]
call fcn.1002bd00
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x100294d6
cmp dword [ebp - 0x30], 1
je 0x100294dd
cmp dword [ebp - 0x30], 3
je 0x1002952c
jmp 0x10029530
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x1002950c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x34]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.100bd79e
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1002950c
xor al, al
jmp 0x10029532
mov edx, dword [ebp - 0x2c]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10029520
mov dword [ebp - 0x38], 1
jmp 0x10029527
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x10029532
mov al, 1
jmp 0x10029532
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a08ba
mov esp, ebp
pop ebp
ret
Function at 0x1003d140
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0856
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x101dccd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x102bd158]
call fcn.100090e0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x102bd160]
call fcn.10008f20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1003d193
jmp 0x1003d244
mov ecx, dword [ebp - 0x10]
call fcn.10008e90
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x102bd870]
mov edx, dword fs:[0x2c]
mov eax, dword [edx + ecx*4]
mov ecx, dword [0x10275e14]
cmp ecx, dword [eax + 4]
jle 0x1003d204
push 0x10275e14
call fcn.100a07c6
add esp, 4
cmp dword [0x10275e14], 0xffffffff
jne 0x1003d204
mov dword [ebp - 4], 0
push str.55_8B_EC_81_EC_________53_56_8B_35_________8B_D9_57_8B_CE
push 0x100ec79c
call fcn.1009bb90
add esp, 8
mov dword [0x10275e10], eax
mov dword [ebp - 4], 0xffffffff
push 0x10275e14
call fcn.100a077c
add esp, 4
movss xmm0, dword [0x100e6b4c]
movss dword [ebp - 0x2c], xmm0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
call fcn.10009030
push eax
call fcn.1003ec60
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1003d244
pushal
movss xmm1, dword [ebp - 0x2c]
push 0
mov ecx, dword [ebp - 0x14]
call dword [0x10275e10]
popal
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100426e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x100426ff
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1004272f
imul edx, dword [ebp + 0xc], 0x1000193
mov eax, 1
imul ecx, eax, 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + ecx]
xor edx, ecx
push edx
mov edx, 1
shl edx, 0
add edx, dword [ebp + 8]
push edx
call fcn.100426e0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret