joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018500
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.10010500
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x1001855e
add eax, 0x10
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.1001bbc5
int3

Function at 0x10019bd0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x10019bf8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x10019c00
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x10019c19
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x10019c21
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x10019c3a
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10019c42
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x10019c5b
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x10019c63
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x10019ca4
add dword [esp], 5
retf
Function at 0x1001a000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10028185
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10034100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov ebx, dword [ebp + 8]
cmp ebx, dword [ebp + 0xc]
je 0x1001a1df
nop dword [eax]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.10019f90
cmp dword [ebp - 0x1c], 0
jne 0x1001a1d0
cmp dword [edi + 8], 0x15555555
je 0x1001a1f3
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.1001d5cf
mov cx, word [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov word [esi + 8], cx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x1c]
inc ecx
mov dword [ebp - 0x14], eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x1002d230]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1002d230]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
seta al
test al, al
je 0x1001a177
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x30], xmm0
fld qword [ebp - 0x30]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x30]
movsd xmm0, qword [ebp - 0x30]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001da90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x14]
cmp eax, ecx
jae 0x1001a150
cmp eax, 0x200
jae 0x1001a14e
shl eax, 3
cmp eax, ecx
jae 0x1001a150
mov eax, ecx
push eax
mov ecx, edi
call fcn.1001b550
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10019f90
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x1001a17a
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
inc dword [edi + 8]
mov ebx, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
jne 0x1001a1b2
mov dword [ecx + eax*8], esi
jmp 0x1001a1c5
cmp dword [ecx + eax*8], edx
jne 0x1001a1bc
mov dword [ecx + eax*8], esi
jmp 0x1001a1c9
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1001a1c9
mov dword [ecx + eax*8 + 4], esi
mov dword [ebp - 4], 0xffffffff
add ebx, 2
mov dword [ebp + 8], ebx
cmp ebx, dword [ebp + 0xc]
jne 0x1001a040
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1001bba5
int3
Function at 0x1001b550
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x1001b68d
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10017870
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x1001b668
mov eax, ecx
movzx edx, byte [eax + 8]
mov ecx, dword [ecx]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x1001b5ec
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x1001b65d
mov edx, dword [ebx + 4]
movzx edi, word [eax + 8]
cmp di, word [edx + 8]
jne 0x1001b625
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1001b620
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x1001b65a
cmp esi, edx
je 0x1001b63d
nop dword [eax]
mov edx, dword [edx + 4]
cmp di, word [edx + 8]
je 0x1001b671
cmp esi, edx
jne 0x1001b630
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x1001b5b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x1001b65a
push str.invalid_hash_bucket_count
call fcn.1001bba5
int3
Function at 0x1001b6a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x1001b748
mov eax, dword [ebx + 0x1c]
shr eax, 3
push esi
cmp eax, ecx
jbe 0x1001b7f0
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x1001b747
mov eax, dword [edx + 4]
mov esi, edx
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push edi
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], edi
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1001d5ff
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x1001b74d
cmp esi, dword [ebp - 4]
jne 0x1001b713
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x1001b73e
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x1001b761
mov dword [ecx], edx
mov eax, edx
jmp 0x1001b764
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
cmp esi, edx
je 0x1001b73e
nop dword [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop dword [eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.1001d5ff
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x1001b7d2
cmp esi, dword [ebp - 4]
jne 0x1001b7a0
mov eax, dword [ebp - 0x14]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, edx
jne 0x1001b770
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx]
test eax, eax
je 0x1001b815
mov esi, dword [eax]
push 0xc
push eax
call fcn.1001d5ff
add esp, 8
mov eax, esi
test esi, esi
jne 0x1001b802
mov eax, dword [ebx + 4]
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 4], eax
mov dword [ebx + 8], 0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.10011000
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e6a0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001e5d0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x1001e6ca
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x1001e6d6
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x1001e6e0
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001e5d0
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1001e70a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x1001e9a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1001e9c7
mov ecx, 5
int 0x29
push 2
call fcn.1001df6a
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1001ead2
test esi, esi
jne 0x1001ead2
push 2
call fcn.1001df6a
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001d60d
mov esp, ebp
pop ebp
ret
Function at 0x100221e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10022210
mov esi, dword [ebp + 8]
test al, al
je 0x100221fe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10022220
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10026690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100266bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100266bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x20403620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub esp, 0x1c
mov eax, dword [0x204a31e0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
mov ebx, ecx
push esi
mov esi, dword [edi + 0xc]
mov dword [esp + 0x10], ebx
lea ebx, [ebx]
mov ecx, dword [edi + 8]
cmp ecx, esi
jae 0x204036a6
mov eax, dword [edi]
mov al, byte [ecx + eax]
add ecx, 1
test edx, edx
mov dword [edi + 8], ecx
je 0x2040367c
cmp al, 0x26
je 0x204036ba
test al, al
js 0x2040382b
cmp al, 0xd
je 0x20403640
cmp al, 0xa
je 0x20403640
cmp al, 9
movsx cx, al
mov word [ebx], cx
jne 0x2040368f
mov word [ebx], 0x20
jmp 0x2040368f
cmp al, 0xd
je 0x20403640
cmp al, 0xa
je 0x20403640
cmp al, 9
je 0x20403675
movsx dx, al
mov word [ebx], dx
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.20478952
add esp, 0x1c
ret
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.20478952
add esp, 0x1c
ret
cmp ecx, esi
jae 0x204036a6
mov edx, dword [edi]
mov al, byte [ecx + edx]
add ecx, 1
cmp al, 0x23
mov byte [esp + 0xf], al
mov dword [edi + 8], ecx
jne 0x20403740
lea esi, [esp + 0xf]
mov eax, edi
call fcn.204035a0
test eax, eax
je 0x204036a6
mov al, byte [esp + 0xf]
cmp al, 0x78
je 0x204036fa
cmp al, 0x58
je 0x204036fa
mov ecx, edi
call fcn.20403560
mov ebp, 0xa
jmp 0x204036ff
mov ebp, 0x10
xor ebx, ebx
mov ecx, dword [edi + 8]
cmp ecx, dword [edi + 0xc]
jae 0x204036a6
mov eax, dword [edi]
mov al, byte [ecx + eax]
add ecx, 1
cmp al, 0x3b
mov dword [edi + 8], ecx
je 0x20403734
lea esi, [esp + 0x14]
mov ecx, ebp
call fcn.204035c0
test eax, eax
je 0x204036a6
imul ebx, ebp
add ebx, dword [esp + 0x14]
jmp 0x20403701
mov ecx, dword [esp + 0x10]
mov word [ecx], bx
jmp 0x2040368f
mov ecx, edi
call fcn.20403560
mov esi, dword [edi + 0xc]
xor edx, edx
lea esp, [esp]
mov eax, dword [edi + 8]
cmp eax, esi
jae 0x204036a6
mov ecx, dword [edi]
mov cl, byte [eax + ecx]
add eax, 1
cmp cl, 0x3b
mov dword [edi + 8], eax
je 0x2040378b
mov byte [esp + edx + 0x18], cl
add edx, 1
cmp edx, 9
jb 0x20403750
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.20478952
add esp, 0x1c
ret
mov esi, dword [sym.imp.MSVCR80.dll__stricmp]
mov byte [esp + edx + 0x18], 0
lea edx, [esp + 0x18]
push 0x20483db0
push edx
call esi
add esp, 8
test eax, eax
jne 0x204037b3
mov word [ebx], 0x3c
jmp 0x2040368f
lea eax, [esp + 0x18]
push 0xe58955b4
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x3a0
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
nop
lea esi, [esi]
and al, 0x40
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441008]
jne 0x401010
repz ret
jmp fcn.0040189a

Function at 0x40923e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004053ae
and dword [ebp - 4], 0
cmp dword [0x443774], 0
mov ebx, eax
jne 0x4092ef
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a0
push eax
call fcn.0040533c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x443774], eax
call esi
push eax
call fcn.0040533c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x443778], eax
call esi
push eax
call fcn.0040533c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44377c], eax
call esi
push eax
call fcn.0040533c
pop ecx
mov dword [0x443784], eax
test eax, eax
je 0x4092ef
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040533c
pop ecx
mov dword [0x443780], eax
mov eax, dword [0x443780]
cmp eax, ebx
je 0x409347
cmp dword [0x443784], ebx
je 0x409347
push eax
call fcn.004053b7
push dword [0x443784]
mov esi, eax
call fcn.004053b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409347
test edi, edi
je 0x409347
call esi
test eax, eax
je 0x40933e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40933e
test byte [ebp - 0xc], 1
jne 0x409347
or dword [ebp + 0x10], 0x200000
jmp 0x409380
mov eax, dword [0x443778]
cmp eax, ebx
je 0x409380
push eax
call fcn.004053b7
pop ecx
test eax, eax
je 0x409380
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409380
mov eax, dword [0x44377c]
cmp eax, ebx
je 0x409380
push eax
call fcn.004053b7
pop ecx
test eax, eax
je 0x409380
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443774]
call fcn.004053b7
pop ecx
test eax, eax
je 0x4093a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b750
Capabilities:
Set console window title

Disassembly:
sub esp, 0x1c
cmp dword [0x2afc1b4], 0x930
jne 0x40b76a
push str.tiyayejetupoxasowujozizoc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x2afc1b4], 0x114e
mov eax, dword [esp + 0x20]
mov dword [0x2afbed0], eax
jne 0x40b791
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
lea ecx, [esp]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
add esp, 0x1c
ret
Function at 0x100012f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x1000efb8
call fcn.1000eecd
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], esi
mov dword [edi], ebx
cmp dword [ebp + 0xc], ebx
je 0x1000131f
mov eax, 0x80040110
jmp 0x100014e8
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.10006d4f
test eax, eax
je 0x1000134d
mov eax, 0x80040112
jmp 0x100014e8
mov edx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010874
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x10001499
inc ecx
cmp ecx, 4
jne 0x10001352
call fcn.10006d4f
test eax, eax
je 0x100014e3
push 4
mov ecx, ebx
pop edx
mov eax, dword [esi + ecx*4]
mov esi, 0x10010884
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100013f1
inc ecx
cmp ecx, edx
jne 0x10001382
mov ecx, dword [0x1001640c]
test ecx, ecx
jne 0x100013e5
push 0x10
pop ecx
call fcn.10001222
mov ecx, eax
mov dword [ebp - 0x220], ecx
test ecx, ecx
je 0x100013cf
inc dword [0x10016410]
mov dword [ecx], vtable.CShellExtension.0
mov byte [ecx + 4], bl
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
jmp 0x100013d1
mov ecx, ebx
mov dword [0x1001640c], ecx
test ecx, ecx
jne 0x100013e5
mov eax, 0x8007000e
jmp 0x100014e8
mov eax, dword [ecx]
push edi
push esi
push ecx
call dword [eax]
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [esi + ecx*4]
mov esi, 0x1001034c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, edx
jne 0x100013f3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], edx
push eax
lea eax, [ebp - 0x228]
mov esi, ebx
push eax
push str.ShowCacheFolder
push str.SoftwareMicrosoftOffice16.0MS_Project
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x1000145a
cmp dword [ebp - 0x22c], eax
sete al
mov dword [ebp - 0x220], eax
mov esi, eax
push 0x58
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
test eax, eax
je 0x10001479
lea ecx, [esi + 1]
push ecx
mov ecx, eax
call fcn.10006d4f
mov ebx, eax
test ebx, ebx
je 0x100013db
push edi
push dword [ebp - 0x21c]
mov eax, dword [ebx]
push ebx
call dword [eax]
mov ecx, dword [ebx]
mov esi, eax
push ebx
call dword [ecx + 8]
mov eax, esi
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010b2c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, 4
jne 0x1000149b
push 0x4c
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x100014d3
mov ecx, eax
call fcn.10007cce
mov ebx, eax
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100013db
push edi
push esi
jmp 0x10001488
mov eax, 0x80004002
call fcn.1000ee8c
ret 0x10