joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4783f0
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x478418
add eax, 0xc
add esp, 0x1c
ret
call fcn.00477470
test eax, eax
jne 0x47840d
jmp 0x478410

Function at 0x478450
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004775c0
mov dword [eax + 4], esi
mov ebx, eax
mov eax, dword [eax + 0xb4]
test eax, eax
je 0x478472
call fcn.004775f0
test byte [ebx + 0x20], 0x30
jne 0x47848c
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_longjmp]
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
push edx
test eax, eax
je 0x4784cd
cmp dword [ebx + 0x14], 0
mov eax, dword [eax + 0x18]
je 0x47850d
mov dword [ebx + 0x68], 1
mov esi, dword [ebx + 4]
test eax, eax
je 0x4784c2
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov dword [ebx + 0x18], eax
test byte [ebx + 0x24], 4
jne 0x4784d6
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push ecx
mov dword [ebx + 0x14], eax
mov eax, ebx
call fcn.00477390
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x4784cd
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x478521
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
jmp 0x4784ee

Function at 0x478530
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x5398c0]
test eax, eax
jne 0x478540
xor eax, eax
ret
sub esp, 0x1c
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x478580
mov edx, dword [eax + 0x10]
test edx, edx
jle 0x478570
xor eax, eax
add esp, 0x1c
ret
test byte [eax + 0x20], 3
je 0x478564
mov eax, dword [eax + 0x24]
and eax, 1
jmp 0x478566
call fcn.00477470
test eax, eax
jne 0x47855d
jmp 0x478564

Function at 0x478590
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x4785d0
mov edx, dword [esp + 0x20]
test edx, edx
jle 0x4785c0
lock add dword [eax + 0x10], 1
add esp, 0x1c
ret
lock sub dword [eax + 0x10], 1
add esp, 0x1c
ret
call fcn.00477470
test eax, eax
jne 0x4785ad
add esp, 0x1c
ret
Function at 0x4786d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x478740
test byte [ebx + 0x20], 0xc
jne 0x478700
mov eax, dword [0x5398c0]
test eax, eax
jne 0x478710
add esp, 0x14
pop ebx
pop esi
ret
lea esi, [ebx + 0x1c]
mov dword [esp], esi
call fcn.00479ca0
movzx eax, byte [ebx + 0x20]
test al, 3
je 0x478732
mov edx, dword [ebx + 0x24]
test dl, 1
je 0x478732
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jle 0x478751
mov dword [esp], esi
call fcn.00479fe0
add esp, 0x14
pop ebx
pop esi
ret
call fcn.00477470
mov ebx, eax
test eax, eax
jne 0x4786f1
add esp, 0x14
pop ebx
pop esi
ret
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [ebx + 0x24], edx
mov byte [ebx + 0x20], al
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x478771
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
mov dword [esp], esi
call fcn.00479fe0
call fcn.004785e0
nop
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
test eax, eax
je 0x478800
mov dword [esp], eax
call fcn.004799e0
mov edi, eax
mov eax, 0xfffffffe
cmp eax, edi
mov eax, 0
sbb eax, edx
jb 0x478840
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov esi, edi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x4788a0
test edi, edi
je 0x47881a
call fcn.004786d0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x478878
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00479af0
call fcn.004786d0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x478890
call fcn.004786d0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.004786d0
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov esi, 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
jne 0x4787d2
call fcn.00477470
mov ebx, eax
jmp 0x4787d2
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x4787ee
call fcn.00477470
jmp 0x47881a
call fcn.00477470
mov ebx, eax
jmp 0x4787ce
Function at 0x4788b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.004773b0
mov eax, dword [0x4b83cc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x478928
test esi, esi
je 0x478900
call fcn.004786d0
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x478938
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00479af0
call fcn.004786d0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.004786d0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.004786d0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
call fcn.00477470
mov ebx, eax
jmp 0x4788d5
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
jmp 0x4788f1
Function at 0x485fd0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x539920
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x539918]
sub esp, 4
test ebx, ebx
je 0x486025
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x48601e
test esi, esi
je 0x48601e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x486000
mov dword [esp], 0x539920
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x486360
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x486385
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x486390
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x486385
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4863d8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4863ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4863da
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4863c0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x48bc10
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x53997c], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x539980], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x48bc80
mov dword [esp + 4], 0x48bb20
mov dword [esp], eax
mov dword [0x539978], eax
call fcn.00499d90
test eax, eax
jne 0x4b1ee5
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x48bc6a
Function at 0x48bc90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x4b83e8]
mov eax, dword [esp + 0x40]
test edx, edx
jne 0x48bcb8
mov eax, dword [eax + 8]
test eax, eax
je 0x48bd18
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [eax + 8]
test edi, edi
je 0x48bd30
mov ebx, dword [0x539978]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x48bdb0
mov edx, dword [ebx]
cmp edx, edi
jb 0x48be00
sub edi, 1
mov eax, dword [ebx + edi*4 + 4]
test eax, eax
jne 0x48bcac
mov eax, dword [esp + 0x40]
call fcn.0048bb70
mov dword [ebx + edi*4 + 4], eax
jmp 0x48bcac
mov eax, dword [esp + 0x40]
call fcn.0048bb70
mov ecx, dword [esp + 0x40]
mov dword [ecx + 8], eax
jmp 0x48bcac
mov ebp, dword [0x4b83e8]
test ebp, ebp
je 0x48be76
mov edi, dword [0x4b83fc]
test edi, edi
je 0x48bea0
lock add dword [0x53997c], 1
jne 0x48bed8
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
test edi, edi
je 0x48be85
mov eax, dword [0x4b83e8]
test eax, eax
je 0x48bcbf
lock sub dword [0x53997c], 1
js 0x48bcbf
mov eax, dword [0x539980]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
sub esp, 0xc
jmp 0x48bcbf
lea eax, [edi + 0x21]
mov dword [esp + 4], 4
lea edx, [edi + 0x20]
mov dword [esp], eax
mov dword [esp + 0x18], edx
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x4b1eea
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov eax, dword [0x539978]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x48bcfb
call ebp
jmp 0x48bcfb
lea ecx, [edx + edx]
lea eax, [edi + 0x20]
mov dword [esp], ebx
cmp ecx, edi
mov dword [esp + 0x1c], edx
cmovb ecx, eax
lea eax, [ecx*4 + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
mov ebx, eax
test eax, eax
je 0x4b1eea
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [eax], ecx
sub ecx, edx
lea eax, [eax + edx*4 + 4]
shl ecx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memset
jmp 0x48bdda
call fcn.0048bc10
mov dword [0x4b83fc], 1
mov edx, dword [0x4b83e8]
test edx, edx
jne 0x48bd4c
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
test edi, edi
jne 0x48bcbf
mov eax, dword [0x539974]
lea edi, [eax + 1]
mov dword [0x539974], edi
mov eax, dword [esp + 0x40]
mov dword [eax + 8], edi
jmp 0x48bd69
lock add dword [0x4b8400], 1
je 0x48be59
mov esi, dword [0x4b83fc]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x48be68
lea esi, [esi]
mov dword [esp], 0
call ebx
mov ecx, dword [0x4b83fc]
sub esp, 4
test ecx, ecx
je 0x48bec0
jmp 0x48be68
mov eax, dword [0x539980]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x48bd5a
lock sub dword [0x53997c], 1
jmp 0x48bd5a
Function at 0x49c2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4fef2d
push ebx
sub esp, 0x9c
mov eax, dword [0x4fef2c]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4fef91]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.00486630
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004b1a44
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b8524], 0
jne 0x49c3c6
mov byte [0x4b8524], 1
call fcn.004ab380
test eax, eax
je 0x49c394
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00485390
mov dword [esp], 2
mov esi, dword [fcn.00499490]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x49c384
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4feb99
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4b14c4
jmp 0x4b14bc
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x49c34a
mov dword [esp], 2
call dword [0x4b8490]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4b14b7
mov dword [esp], 2
call dword [0x4b8490]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40208b
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push 0
push 2
push 0x404052
push 0x404044
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
jne 0x402103
mov byte [0x404067], al
push 0x404067
push 0x404070
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
cmp eax, 1
jne 0x402103
call fcn.00403535
push edx
mov eax, eax
push 0
push 2
push 0x404052
push 0x404054
call dword [sym.imp.Winmm.dll_mciSendStringA]
pop edx
add edx, eax
push edx
push 2
push 0x404069
push 0x404070
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
pop edx
add dl, byte [0x404069]
add edx, 0x100
call edx
xor eax, eax
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x403570
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
ret
Function at 0x100038c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1006c188]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm1, xmmword [ebp + 8]
push esi
movups xmm0, xmmword [ebp + 0x18]
mov esi, dword [ebp + 0x28]
movd eax, xmm1
push edi
mov edi, dword [ebp + 0x2c]
push eax
movups xmmword [ebp - 0x404], xmm0
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3f4], eax
call fcn.10015c80
add esp, 4
test eax, eax
je 0x100039a9
push 0x3e8
add eax, 0x10
push edi
push eax
call fcn.1003adcd
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003922
sub eax, edx
xor edi, edi
sar eax, 1
mov esi, 0x1505
push ebx
lea ebx, [eax + eax]
test ebx, ebx
je 0x10003969
mov eax, esi
mov ecx, edi
shld edi, esi, 5
shl esi, 5
add esi, eax
adc edi, ecx
mov ecx, dword [ebp - 0x3f0]
movzx eax, byte [ecx]
cdq
add esi, eax
adc edi, edx
inc ecx
mov dword [ebp - 0x3f0], ecx
sub ebx, 1
jne 0x10003940
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10003ac0
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100358ad
mov esp, ebp
pop ebp
ret
Function at 0x1000dce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1000dd11
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1000dd00
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10011e60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ff28
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x1006c188]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x44], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], eax
call fcn.10018820
mov ebx, edx
mov edi, eax
or eax, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x3c], edi
mov ecx, edi
mov dword [ebp - 0x38], ebx
je 0x10011f2b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10018b50
test eax, eax
mov eax, dword [ebp + 8]
je 0x10011eff
mov ecx, edi
mov edx, ebx
cmp dword [ebp - 0x18], eax
je 0x10011f2b
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.100189c0
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movlpd qword [ebp - 0x24], xmm0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ebx
or ecx, edx
mov dword [ebp - 4], 0
je 0x10011f8d
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x10011f58
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.100156b0
jmp 0x10011f69
mov ecx, dword [eax + 8]
push edi
push ecx
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x10011f8d
push dword [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10011fbd
mov eax, dword [esi + 4]
push ebx
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov eax, edi
mov dword [ebp - 4], 1
or eax, ebx
je 0x10012017
push 0x4000
push dword [ebp + 8]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.100189c0
mov edx, dword [ebp - 0x18]
jmp 0x10012019
cmp dword [esi + 0x18], 0
je 0x10011ff4
cmp dword [esi + 0x10], 0
je 0x10011ff4
xorps xmm0, xmm0
push ebx
movlpd qword [ebp - 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push 0
push 8
push eax
push ebx
push edi
push dword [esi]
call fcn.10017490
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
jmp 0x10011f96
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x1c]
xor ecx, ecx
jmp 0x10011f93
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4