joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501234
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x50126c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ff2af
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ff287
jmp 0x501278
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x502a2b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x502a6d
call fcn.00509097
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x502a6d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x502a64
xor eax, eax
jmp 0x502a75
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00502a7b
pop edi
pop esi
pop ebx
ret 4

Function at 0x5095c7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5095f5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x509613
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0050952d
jmp 0x509613
mov eax, dword [esi + 0x14]
test eax, eax
je 0x509613
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0050952d
test edi, edi
mov eax, edi
jne 0x5095fd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010c0
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
mov ecx, dword [0x426068]
push ebx
mov ebx, dword [0x42606c]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
xor esi, esi
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x30], ecx
call fcn.004010b0
mov edx, dword [0x426070]
mov eax, dword [0x426074]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
jmp 0x401122
xor esi, esi
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0x84587c]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40117b
push esi
lea ecx, [ebp - 0x38]
push ecx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
push esi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edx, edx
xor eax, eax
lea ecx, [ebp - 0x3c]
push ecx
mov word [ebp - 0x1c], dx
mov word [ebp - 0x1a], ax
mov edx, dword [ebp - 0x1c]
push edx
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov eax, dword [ebp - 4]
mov ecx, dword [0x84587c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x401195
mov dword [0x845878], 0xedeb2e40
jmp 0x4011b5
cmp ecx, 0x3eb
jne 0x4011b5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov dword [0x84522c], esi
mov ecx, dword [ebp - 8]
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
mov edx, edi
shr edx, cl
mov dword [0x845874], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 8]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
nop
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
shr esi, cl
mov ecx, dword [ebp - 4]
push eax
push ecx
add esi, ebx
call fcn.00401090
cmp dword [0x84587c], 0xb03
mov dword [ebp - 4], eax
jne 0x40123e
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, esi
mov dword [ebp - 4], eax
sub edi, eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
sub dword [ebp - 0x20], 1
jne 0x401120
cmp dword [0x84587c], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x401286
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp - 0xc]
pop edi
mov dword [esi + 4], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401680
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x84587c], 0x400
push esi
push edi
jne 0x4016a4
lea eax, [ebp - 0x24]
call fcn.00401760
lea esi, [ebp - 0x24]
call fcn.00401780
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov ebx, dword [ebp - 4]
xor esi, esi
call edi
cmp esi, 0x2af054
jle 0x4016c2
cmp ebx, 0x787e04e5
jne 0x4016cb
inc esi
cmp esi, 0x1d8d
jl 0x4016b0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
lea esp, [esp]
push 0
call edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, 0x206d47
jg 0x4016fd
inc esi
cmp esi, 0x4f6a4
jl 0x4016e0
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
pop ebx
push 0
call edi
cmp esi, 0x2b2589
jg 0x40171b
inc esi
cmp esi, 0x11915
jl 0x401706
mov eax, dword [0x4262ac]
mov dword [0x84587c], eax
call fcn.004013f0
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, 0x3078f
jmp 0x401740
cmp dword [0x84587c], 0x51f
jne 0x401750
push 0
call esi
sub edi, 1
jne 0x401740
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404830
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4252c0]
jne 0x40483a
repz ret
jmp fcn.00408d0d
Function at 0x408a30
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405297
and dword [ebp - 4], 0
cmp dword [0x427c68], 0
mov ebx, eax
jne 0x408ae1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408b92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408b92
push eax
call fcn.00405225
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x427c68], eax
call esi
push eax
call fcn.00405225
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x427c6c], eax
call esi
push eax
call fcn.00405225
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x427c70], eax
call esi
push eax
call fcn.00405225
pop ecx
mov dword [0x427c78], eax
test eax, eax
je 0x408ae1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405225
pop ecx
mov dword [0x427c74], eax
mov eax, dword [0x427c74]
cmp eax, ebx
je 0x408b39
cmp dword [0x427c78], ebx
je 0x408b39
push eax
call fcn.004052a0
push dword [0x427c78]
mov esi, eax
call fcn.004052a0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408b39
test edi, edi
je 0x408b39
call esi
test eax, eax
je 0x408b30
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408b30
test byte [ebp - 0xc], 1
jne 0x408b39
or dword [ebp + 0x10], 0x200000
jmp 0x408b72
mov eax, dword [0x427c6c]
cmp eax, ebx
je 0x408b72
push eax
call fcn.004052a0
pop ecx
test eax, eax
je 0x408b72
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408b72
mov eax, dword [0x427c70]
cmp eax, ebx
je 0x408b72
push eax
call fcn.004052a0
pop ecx
test eax, eax
je 0x408b72
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x427c68]
call fcn.004052a0
pop ecx
test eax, eax
je 0x408b92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408b94
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x24e410f4
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x39835538
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x7062de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x7062fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7062ec
add dl, dl
jne 0x706306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x706352
xor eax, eax
add dl, dl
jne 0x706313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7063ef
add dl, dl
jne 0x706322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x70632d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x706338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x706343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x70634d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x7062f2
mov eax, 1
add dl, dl
jne 0x706360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x70636b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x706357
sub eax, 2
jne 0x70639a
mov ecx, 1
add dl, dl
jne 0x706380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x70638b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x706377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7062f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7063b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7063bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7063a8
cmp eax, 0x7d00
jae 0x7063df
cmp eax, 0x500
jb 0x7063da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7062f2
cmp eax, 0x7f
ja 0x7063e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7062f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x70640b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7062f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x10007910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faf33
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x1019d128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
lea edi, [esi + 0xc]
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [esi], vtable.EventInterface.0
mov dword [ebp - 0x10], edi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
mov byte [ebp - 4], 2
push 0x10112d5f
mov word [edi], 0
call fcn.10019880
mov word [edi + 0x1c], 0
mov byte [ebp - 4], 3
lea ecx, [edi + 4]
mov al, byte [ebp + 0xc]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov byte [edi], al
mov al, byte [ebp + 0xd]
mov byte [edi + 1], al
lea eax, [ebp + 0x10]
cmp ecx, eax
je 0x100079bf
cmp dword [ebp + 0x24], 0x10
push dword [ebp + 0x20]
cmovae eax, dword [ebp + 0x10]
push eax
call fcn.10019880
mov al, byte [ebp + 0x28]
mov byte [edi + 0x1c], al
mov al, byte [ebp + 0x29]
mov byte [edi + 0x1d], al
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
call fcn.100b6b62
mov ecx, dword [ebp + 0x24]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edx
cmp ecx, 0x10
jb 0x10007a0c
mov edx, dword [ebp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10007a02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007a21
push ecx
push edx
call fcn.100cd550
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x24
call fcn.100d2a79
int3

Function at 0x1000b780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb1f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1019d128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100cd563
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100b60ed
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fd30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.10020090
mov eax, dword [ebp - 8]
test eax, eax
je 0x1001fd86
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.100b5e69
int3

Function at 0x10020200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x1002022b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10020214
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x10030830
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1003099d
lea eax, [ecx - 1]
mov esi, dword [0x101a2004]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101a200c
lea eax, [edi + edi]
push eax
call fcn.100301c0
mov eax, dword [0x101a2004]
lea ebx, [edi - 1]
mov dword [0x101a2018], ebx
mov dword [0x101a201c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10030994
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101a200c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100308f2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1003095f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1003092c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10030924
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1003095f
cmp ebx, edx
je 0x1003093c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10030970
cmp ebx, edx
jne 0x10030930
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10030994
mov ebx, dword [0x101a2018]
jmp 0x100308a0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1003095f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.100b5e49
int3
Function at 0x100344b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1003450e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100344d0
mov eax, dword [edi]
jmp 0x100345f9
cmp eax, 0x4e0
jb 0x100345f9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10034530
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10034580
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10039360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0xc]
not eax
mov dword [ebp - 4], ebx
cmp edi, 8
jb 0x1003940f
mov ecx, edi
shr ecx, 3
mov dword [ebp + 8], ecx
mov ebx, dword [esi + 4]
sub edi, 8
mov ecx, dword [esi]
add esi, 8
xor ecx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
mov dword [ebp + 0xc], ecx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*4 + 0x10138400]
mov edx, dword [ebp + 0xc]
xor eax, dword [ecx*4 + 0x10138800]
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
xor eax, dword [ecx*4 + 0x10139400]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x10139800]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10138000]
mov ecx, edx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x10139000]
movzx ecx, bl
xor eax, dword [ecx*4 + 0x10138c00]
movzx ecx, dl
xor eax, dword [ecx*4 + 0x10139c00]
sub dword [ebp + 8], 1
jne 0x10039387
mov ebx, dword [ebp - 4]
test edi, edi
je 0x1003942d
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10138000]
sub edi, 1
jne 0x10039413
pop edi
not eax
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10039570
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x101961b0
push 0x100ceed0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1019d128]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x10039613
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10039613
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10039613
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10039613
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1003961c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100cd51f
mov esp, ebp
pop ebp
ret