joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1048c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x100c7d0
push 0x80000002
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1048c71
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x100c790
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1048c71
cmp dword [ebp - 0xc], 4
jne 0x1048c71
cmp dword [ebp - 0x10], 1
sete al
leave
ret
xor eax, eax
leave
ret

Function at 0x1048cb3
Capabilities:
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 8
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
test eax, eax
jne 0x1048ce5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
call sub.Secur32.dll_GetUserNameExW
movzx eax, al
leave
ret 8

Function at 0x104ba2a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0103563d
leave
ret

Function at 0x104bd49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
xor edi, edi
call fcn.0104bb84
mov esi, eax
test esi, esi
jne 0x104bd86
mov eax, dword [section..data]
cmp eax, section..data
je 0x104bdad
test byte [eax + 0x1c], 2
je 0x104bdad
push 0x100ce14
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141c0
jmp 0x104bdad
movzx eax, word [ebp + 0xc]
push 5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x104bdad
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x104bdad
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x104c239
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [0x10541e0]
cmp eax, 1
push esi
mov esi, 0x80004005
je 0x104c252
cmp eax, 3
jne 0x104c35c
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
call esi
mov dword [0x1055404], eax
call esi
push 0x105555c
mov dword [0x1055408], eax
call fcn.0104c0cc
mov esi, eax
test esi, esi
jge 0x104c2ad
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c35c
test byte [eax + 0x1c], 2
je 0x104c35c
push esi
push 0x100cee8
push 0x100ce90
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01040d30
jmp 0x104c35c
push 0x1055570
call fcn.0104c4b1
mov esi, eax
test esi, esi
jge 0x104c2e6
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c35c
test byte [eax + 0x1c], 2
je 0x104c35c
push esi
push 0x100cea0
push 0x100ce90
push 0xb
jmp 0x104c29d
and dword [0x105540c], 0
push edi
xor eax, eax
mov edi, 0x1055560
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.0104c638
mov esi, eax
test esi, esi
pop edi
jge 0x104c32a
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c35c
test byte [eax + 0x1c], 2
je 0x104c35c
push 0x100ce90
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141c0
jmp 0x104c35c
call fcn.0104c88d
mov esi, eax
test esi, esi
jge 0x104c350
mov eax, dword [section..data]
cmp eax, section..data
je 0x104c35c
test byte [eax + 0x1c], 2
je 0x104c35c
push 0x100ce90
push 0xd
jmp 0x104c31d
mov dword [0x10541e0], 2
xor esi, esi
mov eax, esi
pop esi
ret
Function at 0x104d361
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x14
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
jne 0x104d392
push 3
pop eax
jmp 0x104d486
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
mov edi, 0x100d454
push edi
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x104d3d9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x2001f
push ebx
push 0x100d448
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x104d3e7
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
cmp eax, ebx
jne 0x104d43f
cmp dword [ebp - 8], 2
jne 0x104d40b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x100d43c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 8], 1
je 0x104d41b
cmp eax, ebx
jne 0x104d41b
cmp dword [ebp - 0x10], 0x14
je 0x104d474
cmp dword [ebp - 0x14], ebx
je 0x104d444
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x104d444
push 0x13
pop eax
jmp 0x104d485
push dword [ebp + 8]
call fcn.0104d2ac
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x104d474
push 0x14
push dword [ebp + 8]
push 3
push ebx
push 0x100d43c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x104d474
mov dword [ebp - 0xc], 0x15
cmp dword [ebp - 4], ebx
je 0x104d482
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x104d4e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x18
mov dword [esp + 0x10], ebp
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ebx
mov eax, dword [edx]
mov ebx, dword [edx + 4]
mov ebp, dword [edx + 0xc]
mov edx, dword [edx + 8]
mov esi, dword [ecx + 0x1d0]
add esi, ecx
mov dword [esp + 4], esi
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor edx, dword [ecx + 8]
xor ebp, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
mov dword [esp], ecx
add eax, 0
push ebp
movzx ecx, al
mov ecx, dword [ecx*4 + 0x100dc00]
movzx esi, ah
shr eax, 0x10
mov ebp, dword [esi*4 + 0x100e000]
movzx edi, ah
mov edi, dword [edi*4 + 0x100e800]
movzx eax, al
mov eax, dword [eax*4 + 0x100e400]
movzx esi, bl
xor edi, dword [esi*4 + 0x100dc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [esi*4 + 0x100e000]
movzx esi, bl
xor ebp, dword [esi*4 + 0x100e400]
movzx ebx, bh
xor eax, dword [ebx*4 + 0x100e800]
pop ebx
movzx esi, dl
xor eax, dword [esi*4 + 0x100dc00]
movzx esi, dh
xor edi, dword [esi*4 + 0x100e000]
shr edx, 0x10
movzx esi, dl
xor ecx, dword [esi*4 + 0x100e400]
movzx edx, dh
xor ebp, dword [edx*4 + 0x100e800]
mov esi, dword [esp]
movzx edx, bl
xor ebp, dword [edx*4 + 0x100dc00]
movzx edx, bh
xor eax, dword [edx*4 + 0x100e000]
shr ebx, 0x10
movzx edx, bl
xor edi, dword [edx*4 + 0x100e400]
movzx ebx, bh
xor ecx, dword [ebx*4 + 0x100e800]
mov edx, dword [esi + 8]
xor edx, eax
mov eax, dword [esi]
xor eax, ecx
xor ebp, dword [esi + 0xc]
mov ebx, dword [esi + 4]
xor ebx, edi
add esi, 0x10
cmp esi, dword [esp + 4]
mov dword [esp], esi
jb 0x104d520
push ebp
movzx ecx, al
movzx ecx, byte [ecx + 0x100d800]
movzx esi, ah
shr eax, 0x10
movzx ebp, byte [esi + 0x100d800]
movzx edi, ah
shl ebp, 8
movzx edi, byte [edi + 0x100d800]
movzx eax, al
shl edi, 0x18
movzx eax, byte [eax + 0x100d800]
shl eax, 0x10
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
or edi, esi
movzx esi, bh
shr ebx, 0x10
movzx esi, byte [esi + 0x100d800]
shl esi, 8
or ecx, esi
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx ebx, bh
shl esi, 0x10
movzx ebx, byte [ebx + 0x100d800]
or ebp, esi
shl ebx, 0x18
or eax, ebx
movzx esi, dl
movzx esi, byte [esi + 0x100d800]
movzx ebx, dh
shr edx, 0x10
movzx ebx, byte [ebx + 0x100d800]
or eax, esi
shl ebx, 8
movzx esi, dl
movzx esi, byte [esi + 0x100d800]
or edi, ebx
pop ebx
movzx edx, dh
movzx edx, byte [edx + 0x100d800]
shl esi, 0x10
or ecx, esi
shl edx, 0x18
or ebp, edx
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx edx, bh
shr ebx, 0x10
movzx edx, byte [edx + 0x100d800]
or ebp, esi
shl edx, 8
or eax, edx
mov edx, dword [esp]
movzx esi, bl
movzx esi, byte [esi + 0x100d800]
movzx ebx, bh
movzx ebx, byte [ebx + 0x100d800]
shl esi, 0x10
shl ebx, 0x18
or edi, esi
or ecx, ebx
xor ecx, dword [edx]
xor edi, dword [edx + 4]
xor eax, dword [edx + 8]
xor ebp, dword [edx + 0xc]
mov ebx, dword [esp + 0x1c]
mov dword [ebx], ecx
mov dword [ebx + 4], edi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ebp
mov dword [esp - 4], ebx
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x14]
add esp, 0x18
ret 4
Function at 0x104e9eb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x104ea27
xor eax, eax
jmp 0x104ea52
test eax, eax
jle 0x104ea37
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x104ea52
cmp dword [ebp + 0x10], 4
je 0x104ea46
mov eax, 0x8007000d
jmp 0x104ea52
cmp dword [ebp - 4], 0
jne 0x104ea52
mov dword [edi], 1
pop edi
leave
ret 0xc

Function at 0x104ea5c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0x10]
and dword [edi], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x104ea98
xor eax, eax
jmp 0x104eac3
test eax, eax
jle 0x104eaa8
and eax, 0xffff
or eax, 0x80070000
test eax, eax
jl 0x104eac3
cmp dword [ebp + 0x10], 4
je 0x104eab7
mov eax, 0x8007000d
jmp 0x104eac3
cmp dword [ebp - 4], 0
je 0x104eac3
mov dword [edi], 1
pop edi
leave
ret 0xc

Function at 0x104f1f6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 8
push 0x404
mov esi, 0xc04
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x104f24a
push 3
lea eax, [ebp - 0x44]
push 0x1011710
push eax
call sub.msvcrt.dll_wcsncmp
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xfffff800
add esi, 0xc04
mov ecx, dword [ebp - 4]
mov ax, si
xor ecx, ebp
pop esi
call fcn.0103563d
leave
ret
Function at 0x104f270
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x104f2c9
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x11c]
xor eax, eax
dec ecx
pop esi
je 0x104f31d
dec ecx
jne 0x104f340
cmp edx, 5
jne 0x104f315
mov ecx, dword [ebp - 0x118]
sub ecx, eax
je 0x104f311
dec ecx
je 0x104f306
dec ecx
je 0x104f2f7
push 0x14
jmp 0x104f368
cmp word [ebp - 0xc], 1
jb 0x104f301
push 0x10
pop eax
or eax, 4
jmp 0x104f340
cmp word [ebp - 0xc], 2
jb 0x104f301
push 8
jmp 0x104f300
push 4
jmp 0x104f368
cmp edx, 4
ja 0x104f34c
push 2
pop eax
cmp edx, 4
jne 0x104f340
cmp dword [ebp - 0x118], 0
je 0x104f33d
cmp dword [ebp - 0x118], 0xa
je 0x104f33d
cmp dword [ebp - 0x118], 0x5a
jne 0x104f340
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0103563d
leave
ret
cmp edx, 6
jne 0x104f36b
cmp dword [ebp - 0x118], 0
jne 0x104f36b
cmp dword [ebp - 0x114], 0x1554
jae 0x104f36b
push 0x40
pop eax
jmp 0x104f340
push 0x20
jmp 0x104f368

Function at 0x104f49b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp word [0x1055538], si
jne 0x104f533
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push 0x1011640
push 0x80000002
mov dword [ebp - 0x14], 6
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104f533
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0x10116f8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x104f533
push 3
push dword [esi*8 + 0x1011490]
lea eax, [ebp - 0xc]
push eax
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
je 0x104f525
inc esi
cmp esi, 0x1c
jb 0x104f504
jmp 0x104f533
mov ax, word [esi*8 + 0x1011494]
mov word [0x1055538], ax
mov ecx, dword [ebp - 4]
mov ax, word [0x1055538]
xor ecx, ebp
pop esi
call fcn.0103563d
leave
ret
Function at 0x1036b09
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x15
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
test al, 1
je 0x1036b20
or edx, 3
xor eax, eax
test dl, 1
je 0x1036b36
mov eax, 0x20000
test dl, 2
jne 0x1036b36
mov eax, 0x40000
test dl, 8
je 0x1036b40
or eax, 0x10000
test dl, 0x10
je 0x1036b4a
or eax, 0x400000
mov ecx, 0x20000000
test ecx, edx
je 0x1036b58
or eax, 0x800000
test edx, 0x40000000
je 0x1036b62
or eax, ecx
pop ebp
ret 4

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x2f4069c9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x702d3ae9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x430db0], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x430db0], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430db4], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430db8], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x430dc0], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x430dbc], eax
mov eax, dword [0x430dbc]
cmp eax, ebx
je 0x40575e
cmp dword [0x430dc0], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x430dc0]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x430db4]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x430db8]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430db0]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42c8c9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x43ed24]
push dword [0x43ea40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42c958
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ebx, 0x19f
jne 0x42c96d
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x42c9a9
push esi
and dword [ebp - 8], 0
lea esi, [ebp - 8]
mov dword [ebp - 4], 5
call fcn.0042c94d
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0xa
sub dword [ebp - 4], 0x3c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x42c975
pop esi
pop edi
cmp ebx, 0x2d
jne 0x42c9c0
or dword [0x43ed34], 0xffffffff
mov dword [0x43ed30], 0xa62e7790
leave
ret
Function at 0x10011800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10023830
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10187dff
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x102a67c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x60
push 0
mov word [esi], 0
lea eax, [esi + 0x3c]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x3f800000
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
push eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call sub.VCRUNTIME140.dll_memset
mov byte [esi + 0x9c], 0
xorps xmm0, xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0xf
mov byte [esi + 0xb0], 0
movups xmmword [esi + 0xc8], xmm0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0xf
mov dword [ebp - 4], 0
mov byte [esi + 0xc8], 0
movups xmmword [esi + 0xe0], xmm0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0xf
mov byte [esi + 0xe0], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0xbf800000
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0
push 0x4b0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
add esi, 0x128
push 0
push esi
mov byte [ebp - 4], 2
call sub.VCRUNTIME140.dll_memset
push fcn.10023c10
push 0x14
push esi
call fcn.100235a0
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100285b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10188365
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x102a67c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.100281a0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10028643
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x9249249
je 0x100287a6
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.10184796
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101a0e90]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101a0e90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10028748
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.10184b80
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1002872a
cmp ebx, 0x200
jae 0x10028728
shl ebx, 3
cmp ebx, ecx
jae 0x1002872a
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1002a680
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.100281a0
mov edx, dword [eax]
jmp 0x1002874b
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x10028776
mov dword [ecx + eax*8], esi
jmp 0x10028785
cmp edi, edx
jne 0x1002877f
mov dword [ecx + eax*8], esi
jmp 0x10028789
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10028789
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3