joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d289
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x48d2ae
cmp eax, edi
jge 0x48d2a6
mov eax, esi
call fcn.0048cb42
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x48d2db
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x48d2bb
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x48d2f7
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x48d2e8
xor dl, dl
jmp 0x48d2ed
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x48d2de
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x48d32b
mov dword [0x4fb440], str.zlib_corrupt
xor eax, eax
jmp 0x48d36b
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x48d340
mov dword [0x4fb440], str.read_past_buffer
jmp 0x48d327
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x48d355
mov ecx, edi
call fcn.0048cc75
test eax, eax
je 0x48d327
push edi
push dword [esi]
push dword [esi + 0x10]
call sub.MSVCR100.dll_memcpy
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x49d5f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x49d612
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x49d6bd
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
call fcn.00498dc8
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x49d640
push dword [ebp + 0x10]
call sub.MSVCR100.dll_fclose
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax + 8], edi
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x49d6bc
push ebx
mov ebx, dword [ebp - 4]
cmp ebx, edi
jbe 0x49d64c
mov eax, ebx
jmp 0x49d64f
xor eax, eax
inc eax
push eax
call dword [0x4f89c0]
mov esi, eax
pop ecx
push dword [ebp + 0x10]
cmp esi, edi
jne 0x49d670
call sub.MSVCR100.dll_fclose
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x49d69c
push ebx
push 1
push esi
call sub.MSVCR100.dll_fread
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call sub.MSVCR100.dll_fclose
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x49d6a5
push esi
call dword [0x4f89c4]
mov eax, dword [ebp + 8]
mov dword [eax], 2
mov dword [eax + 8], edi
pop ecx
mov dword [eax + 4], edi
jmp 0x49d6bb
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 8]
call fcn.0049d257
mov eax, dword [ebp + 8]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x49d8e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.0049cb96
mov edi, eax
test edi, edi
je 0x49d91e
push esi
mov ecx, dword [ebp + 0xc]
push edi
mov esi, edi
call fcn.0049cc30
push dword [esi]
mov edi, eax
call sub.MSVCR100.dll_wcslen
push dword [ebp + 8]
inc eax
push eax
push 2
push dword [esi]
call sub.MSVCR100.dll_fwrite
add esp, 0x14
test edi, edi
jne 0x49d8f4
pop esi
pop edi
pop ebp
ret

Function at 0x49d921
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 4]
call fcn.00499df4
and dword [ebp + 8], 0
add esp, 4
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.00412909
mov esi, dword [ebp - 4]
cmp dword [esi - 8], 0
je 0x49d960
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0049d3da
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push ebx
push 1
push eax
call sub.MSVCR100.dll_fwrite
add esp, 0x10
pop edi
lea ecx, [esi - 0xc]
pop esi
pop ebx
cmp ecx, dword [0x4f8020]
je 0x49d985
call fcn.0041117d
leave
ret
Function at 0x49d987
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + 0xc]
call fcn.0049913e
lea ecx, [eax - 1]
cmp ecx, 4
ja 0x49dabd
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jle 0x49da56
push esi
lea ecx, [ebp + 0xc]
call fcn.0049912b
push eax
push edi
call fcn.0049d921
add esp, 0xc
push esi
lea ecx, [ebp + 0xc]
call fcn.0049914e
push eax
push edi
call fcn.0049d921
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
call fcn.0049c086
mov eax, dword [ebp + 0xc]
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00499b4a
test al, al
je 0x49da4a
and dword [ebp - 8], 0
push esi
lea ecx, [ebp - 0x14]
call fcn.00499035
push eax
push edi
call fcn.0049d921
add esp, 0xc
push esi
lea ecx, [ebp - 0x14]
call fcn.00499048
push eax
push edi
call fcn.0049d921
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00499b4a
test al, al
jne 0x49da05
push esi
push 0
push edi
call fcn.0049d921
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp + 0xc]
call fcn.004993b6
cmp dword [ebp - 4], 0
je 0x49daa6
lea ecx, [ebp - 4]
call fcn.0049913e
push esi
push 1
mov byte [ebp + 0x13], al
lea eax, [ebp + 0x13]
push 1
push eax
call sub.MSVCR100.dll_fwrite
mov ecx, dword [ebp - 0xc]
add esp, 0x10
push esi
push dword [ebp - 4]
push edi
call fcn.0049d987
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.0049923c
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
jne 0x49da68
push esi
push 1
lea eax, [ebp + 0xb]
push 1
push eax
mov byte [ebp + 0xb], 0
call sub.MSVCR100.dll_fwrite
add esp, 0x10
pop edi
pop esi
leave
ret 0xc

Function at 0x49eaab
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x4c0188
call fcn.0048652b
fld dword [0x4c5e04]
mov edi, dword [ebp + 8]
push 0xa
sub esp, 0xc
fstp dword [esp + 8]
mov esi, ecx
fld dword [0x4c5e00]
lea ecx, [ebp - 0x50]
fstp dword [esp + 4]
fld dword [0x4c5dfc]
fstp dword [esp]
push 0x11
call fcn.0049dac1
mov eax, dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
push ecx
push eax
mov ecx, esi
call fcn.0049e9bd
lea eax, [ebp - 0x50]
push eax
call fcn.0049d896
mov edx, dword [ebp - 0x4c]
push edi
xor ecx, ecx
inc ecx
push 0x10
mov dword [ebp - 0x14], eax
push ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x6c6d7873
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
call sub.MSVCR100.dll_fwrite
lea eax, [ebp - 0x50]
push eax
push edi
call fcn.0049d8e1
mov eax, dword [esi]
add esp, 0x1c
push edi
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.0049d987
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.0049e7cf
call fcn.004865ae
ret 4
Function at 0x4a01ae
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
push dword [ebp + 0x1c]
inc edi
xor esi, esi
mov dword [ebp - 8], esi
push edi
call fcn.004ae724
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x4a01dd
xor eax, eax
jmp 0x4a02dd
mov ecx, dword [ebp - 4]
mov eax, SysReAllocString
push 0x40
mov dword [ecx + 0x2a4], eax
mov ecx, dword [ebp - 4]
push 0x49ef96
push dword [ebp - 4]
mov dword [ecx + 0x2a8], eax
call fcn.004a0873
push esi
push eax
call sub.MSVCR100.dll__setjmp3
add esp, 0x14
test eax, eax
je 0x4a0218
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.004ae815
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004a08e4
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004a3ba9
add esp, 0x28
test eax, eax
jne 0x4a024f
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4a028d
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.004ae8ea
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x4a028d
mov dword [ebp - 8], edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4a02c4
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.004ae8bf
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], esi
push dword [ebp - 4]
call fcn.004ae797
add esp, 0x14
jmp 0x4a01d6
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.004ae6cf
mov esi, dword [ebp - 4]
add esp, 0x10
call fcn.0049fc25
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x4a244c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x4a2482
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x4a2475
push eax
call fcn.004ae864
push 2
call fcn.004ae850
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x4a415a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor esi, esi
push dword [ebp + 0x1c]
inc esi
xor edi, edi
mov dword [ebp - 8], edi
push esi
call fcn.004ae724
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
jne 0x4a4189
xor eax, eax
jmp 0x4a4330
mov ecx, dword [ebp - 4]
mov eax, SysReAllocString
mov dword [ecx + 0x2a4], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2a8], eax
mov eax, dword [ebp - 4]
push 0x40
mov dword [eax + 0x2ac], edi
mov eax, dword [ebp - 4]
push 0x49ef96
push dword [ebp - 4]
mov dword [eax + 0x2b0], edi
call fcn.004a0873
push edi
push eax
call sub.MSVCR100.dll__setjmp3
add esp, 0x14
test eax, eax
je 0x4a41d6
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.004ae815
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004a08e4
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004a3ba9
add esp, 0x28
test eax, eax
jne 0x4a420d
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4a424b
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.004ae8ea
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], edi
jne 0x4a424b
mov dword [ebp - 8], esi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x4a2376
mov eax, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.004a23c5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xa0], eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4a42c8
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push 0x4d5a1c
push eax
call fcn.004b4dc8
add esp, 0xc
cmp eax, 0xfffffffa
je 0x4a42b6
cmp eax, 0xfffffffc
je 0x4a42af
cmp eax, 0xfffffffe
je 0x4a42a8
cmp eax, edi
je 0x4a42c8
push str.Unknown_zlib_error
jmp 0x4a42bb
push str.zlib_stream_error
jmp 0x4a42bb
push str.zlib_memory_error
jmp 0x4a42bb
push str.zlib_version_error
push dword [ebp - 4]
call fcn.004a0913
pop ecx
mov dword [ebp - 8], esi
pop ecx
mov eax, dword [ebp - 8]
test eax, eax
mov eax, dword [ebp - 4]
je 0x4a42ff
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.004ae8bf
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov dword [eax + 0xb0], edi
push dword [ebp - 4]
call fcn.004ae797
add esp, 0x14
jmp 0x4a4182
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0xb4]
push edi
push edi
push dword [ebp - 4]
mov dword [ecx + 0x88], eax
call fcn.004aafc7
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x4b2e41
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x4b2ed0
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4b2e8e
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4b2eb1
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4b2ffc
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x4b2ef8
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x4b2f03
xor eax, eax
jmp 0x4b2f4f
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x4b2f20
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004b65cf
jmp 0x4b2f30
cmp ecx, 2
jne 0x4b2f39
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.004b4c3c
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edx, dword [esi + 0x74]
cmp edx, 3
jb 0x4b2f77
mov edi, dword [esi + 0x6c]
add edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edi]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edi + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edx, 0x106
jae 0x4b2f8b
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x4b2e4c
mov ecx, dword [esi + 0x16c0]
mov eax, dword [esi + 0x3c]
cmp ecx, eax
jae 0x4b2ffc
mov edi, dword [esi + 0x6c]
add edi, edx
cmp ecx, edi
jae 0x4b2fcb
sub eax, edi
mov ebx, eax
mov eax, 0x102
cmp ebx, eax
jbe 0x4b2fb0
mov ebx, eax
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
add ebx, edi
mov dword [esi + 0x16c0], ebx
jmp 0x4b2ffc
lea edx, [edi + 0x102]
cmp ecx, edx
jae 0x4b2ffc
sub edi, ecx
add edi, 0x102
sub eax, ecx
cmp edi, eax
jbe 0x4b2fe5
mov edi, eax
mov eax, dword [esi + 0x38]
push edi
add eax, ecx
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
leave
ret
Function at 0x412be0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444788
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x455100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov dword [edi + 0x24], 0
mov dword [edi], vtable.std::_Func_impl_no_alloc_class__lambda_14aee469f17924fd2a90659b8f288539___void__struct_HookParam_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [edi + 0x24], edi
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 4], 0
call fcn.0041af50
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push str.EMBED_SHARED_MEM
push eax
call fcn.00411670
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x412c5b
mov eax, dword [eax]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x412ca7
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412c9d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412da9
push ecx
push edx
call fcn.0041f78c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x412cf9
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412cef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412da9
push ecx
push edx
call fcn.0041f78c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x2c], 7
call fcn.0041af50
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 4
mov edx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push edx
call fcn.00411670
add esp, 0xc
lea ecx, [edi + 0x34]
call fcn.00412dc0
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x412d72
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d68
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412dae
push ecx
push edx
call fcn.0041f78c
add esp, 8
push 0xa00
push 0
push 0
push 6
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbeb
mov esp, ebp
pop ebp
ret 8
call fcn.0042469f
call fcn.0042469f
int3
Function at 0x4157b0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444add
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x455100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4570f0
mov dword [ebp - 0x24], 0x4570f0
mov byte [ebp - 0x20], 0
call fcn.0041f21f
add esp, 4
test eax, eax
jne 0x4158f0
cmp dword [0x45711c], 0x7fffffff
je 0x4158f7
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x4570d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411e60
mov eax, dword [eax + 4]
test eax, eax
je 0x4158d3
cmp eax, dword [0x4570d4]
je 0x4158d3
lea eax, [ebp + 8]
mov ecx, 0x4570d0
push eax
call fcn.00419730
push 8
mov esi, eax
call fcn.0041f75c
add esp, 4
test eax, eax
je 0x415892
mov dword [eax], esi
mov dword [eax + 4], 5
jmp 0x415894
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412090
push 0
push 0
call fcn.0042e4d5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x41590f
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x415908
push ecx
push eax
call fcn.0041cf9f
add esp, 8
test eax, eax
jne 0x415908
push 0x4570f0
call fcn.0041f230
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d272
push 6
mov dword [0x45711c], 0x7ffffffe
call fcn.0041d272
push 1
call fcn.0041d272
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d272
int3
Function at 0x415920
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444b31
mov eax, dword fs:[0]
push eax
sub esp, 0x524
mov eax, dword [0x455100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4570f0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b0], 0x4570f0
mov byte [ebp - 0x2ac], 0
call fcn.0041f21f
add esp, 4
test eax, eax
jne 0x415b1e
cmp dword [0x45711c], 0x7fffffff
je 0x415b25
mov byte [ebp - 0x2ac], 1
mov dword [ebp - 0x2a8], 0x4570d0
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
mov byte [ebp - 4], 1
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.00411e60
mov eax, dword [eax + 4]
test eax, eax
je 0x415ad8
cmp eax, dword [0x4570d4]
je 0x415ad8
cmp dword [ebp + 0x2a8], 0
je 0x415a24
lea eax, [ebp + 0x284]
mov ecx, 0x4570d0
push eax
lea eax, [ebp + 8]
push eax
call fcn.00419730
mov ecx, eax
call fcn.00413710
lea eax, [ebp + 8]
mov ecx, 0x4570d0
push eax
call fcn.00419730
mov dword [ebp - 0x530], 2
lea esi, [ebp + 0xc]
mov ecx, 0x9e
mov dword [ebp - 0x298], eax
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xa0
lea esi, [ebp - 0x530]
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push 0x288
call fcn.0041f75c
add esp, 4
test eax, eax
je 0x415a87
mov ecx, 0xa2
lea esi, [ebp - 0x298]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x415a89
xor eax, eax
mov dword [ebp - 0x2a4], eax
lea ecx, [ebp - 0x29c]
mov byte [ebp - 4], 2
push ecx
push 0
push eax
push 0x4120d0
push 0
push 0
call fcn.0042e4d5
add esp, 0x18
mov dword [ebp - 0x2a0], eax
test eax, eax
je 0x415b3d
mov ecx, dword [ebp - 0x29c]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x415b36
push ecx
push eax
call fcn.0041cf9f
add esp, 8
test eax, eax
jne 0x415b36
push 0x4570f0
call fcn.0041f230
mov ecx, dword [ebp + 0x2a8]
add esp, 4
test ecx, ecx
je 0x415b03
mov edx, dword [ecx]
lea eax, [ebp + 0x284]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbeb
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d272
push 6
mov dword [0x45711c], 0x7ffffffe
call fcn.0041d272
push 1
call fcn.0041d272
push 6
mov dword [ebp - 0x29c], 0
call fcn.0041d272
int3