joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
lea edx, [ebp - 4]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x100cbe88]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3f14]
mov eax, dword [edi + 0xfc]
mov ebx, dword [edi + 0x104]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1004a658]
sub esi, 1
jne 0x100146a6
mov eax, dword [0x100cbe88]
not ebx
cmp dword [eax + 0x3f38], ebx
jne 0x100146e0
push ecx
push dword [ebp - 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.100259a0
add esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea ecx, [edi + 0xfc]
call fcn.10025ba0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ab50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x53c8], 0
lea esi, [edi + 0x53cc]
je 0x1001abd2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001ab8c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100265d0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10006ee0
mov edx, dword [esi]
mov ecx, 0x100cbe84
push dword [edi + 0x53c8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x53d4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10006ee0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001afb0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x1001aff8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x1001afdf
cmp byte [esi], bl
jne 0x1001afdf
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1004a658]
test bl, bl
jne 0x1001afd0
mov ebx, dword [0x100cbe88]
mov edi, dword [ebx + 0x53a0]
test edi, edi
je 0x1001b030
lea esi, [edi + 4]
test esi, esi
je 0x1001b030
not eax
cmp dword [esi], eax
je 0x1001b03f
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x5398]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x1001b011
mov ecx, dword [ebp - 4]
call fcn.1001aed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b050
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x100cbe88]
test bl, bl
je 0x1001b096
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001b077
cmp byte [esi], bl
jne 0x1001b077
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1004a658]
test bl, bl
jne 0x1001b068
mov edi, dword [0x100cbe88]
mov esi, dword [edi + 0x538c]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001b0bc
mov edi, dword [edi + 0x5394]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x1001b0c2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x1001b0b0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x1002e6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002e6ea
mov eax, dword [0x100cbe88]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002e6dd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002e71b
mov eax, dword [0x100cbe88]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002e70e
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002e74c
mov eax, dword [0x100cbe88]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002e73f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002e799
mov eax, dword [0x100cbe88]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002e78c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002e7ca
mov eax, dword [0x100cbe88]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002e7bd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002e7fb
mov eax, dword [0x100cbe88]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002e7ee
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10030ff0
Function at 0x10038240
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1005200c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100cbe88]
mov dword [ebp - 0x24], esi
push edi
test esi, esi
je 0x10038265
mov ebx, dword [esi + 0x74]
jmp 0x10038267
xor ebx, ebx
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
movd xmm1, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
cmp byte [ebx + 0x26], 0
je 0x100382a9
call fcn.10038170
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x10]
mov ecx, edi
sub ecx, dword [ebx + 0x10]
mov esi, dword [ebp - 0xc]
mov edx, esi
sbb edx, dword [ebx + 0x14]
call fcn.10049360
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x28], xmm0
call fcn.10049360
movss xmm1, dword [ebp - 0x28]
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 0x24]
divss xmm1, xmm0
movss dword [eax + 0x18], xmm1
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], esi
call fcn.100376d0
mov eax, dword [0x100cbe88]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax + 0x2ecc], 0
je 0x10038352
push 0xa0
call edi
shr eax, 0xf
test al, 1
jne 0x10038352
mov esi, dword [0x100cbe88]
xorps xmm3, xmm3
push 0
push 0x210
lea ecx, [esi + 8]
call fcn.100064c0
mov dword [esi + 0x33c], 0x210
mov dword [esi + 0x8fc], 0xa0
mov eax, dword [0x100cbe88]
cmp byte [eax + 0x2f0c], 0
je 0x1003839a
push 0xa1
call edi
shr eax, 0xf
test al, 1
jne 0x1003839a
mov esi, dword [0x100cbe88]
xorps xmm3, xmm3
push 0
push 0x214
lea ecx, [esi + 8]
call fcn.100064c0
mov dword [esi + 0x340], 0x214
mov dword [esi + 0x90c], 0xa1
mov eax, dword [0x100cbe88]
cmp byte [eax + 0x2eec], 0
je 0x100383df
push 0x5b
call edi
shr eax, 0xf
test al, 1
jne 0x100383df
mov esi, dword [0x100cbe88]
xorps xmm3, xmm3
push 0
push 0x212
lea ecx, [esi + 8]
call fcn.100064c0
mov dword [esi + 0x228], 0x212
mov dword [esi + 0x904], 0x5b
mov eax, dword [0x100cbe88]
cmp byte [eax + 0x2f2c], 0
je 0x10038424
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x10038424
mov esi, dword [0x100cbe88]
xorps xmm3, xmm3
push 0
push 0x216
lea ecx, [esi + 8]
call fcn.100064c0
mov dword [esi + 0x22c], 0x216
mov dword [esi + 0x914], 0x5c
mov eax, dword [ebp - 0x24]
cmp byte [eax + 0x60], 0
je 0x10038432
or eax, 0xffffffff
jmp 0x1003843d
mov eax, dword [0x100cbe88]
mov eax, dword [eax + 0x429c]
cmp dword [ebx + 0x20], eax
je 0x1003844a
mov dword [ebx + 0x20], eax
call fcn.100375a0
call fcn.100379b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047d31
mov esp, ebp
pop ebp
ret
Function at 0x10045830
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049785
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1005200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.100464d0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100458b3
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10045a16
cmp dword [0x100cbf50], 0xfffffff
jne 0x100458ca
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x100cbf4c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.10047d3f
mov ecx, dword [ebx]
mov esi, eax
mov edx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov ecx, dword [0x100cbf50]
mov ebx, dword [0x100cbf64]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004ff90]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1004ff90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x100cbf48]
comiss xmm1, xmm0
jbe 0x100459c3
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10048fe0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100459a2
cmp ebx, 0x200
jae 0x100459a0
shl ebx, 3
cmp ebx, ecx
jae 0x100459a2
mov ebx, ecx
push ebx
call fcn.10045a50
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100464d0
mov ecx, dword [0x100cbf50]
mov edx, dword [eax]
jmp 0x100459c9
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x100cbf50], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x100cbf60]
mov ecx, dword [0x100cbf54]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x100cbf4c]
jne 0x100459fa
mov dword [ecx + eax*8], esi
jmp 0x10045a09
cmp edi, edx
jne 0x10045a03
mov dword [ecx + eax*8], esi
jmp 0x10045a0d
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10045a0d
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10045a50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10045a7c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100cbf4c]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100cbf54
lea eax, [edi + edi]
push eax
call fcn.10043670
mov ecx, dword [0x100cbf4c]
lea ebx, [edi - 1]
mov dword [0x100cbf60], ebx
mov dword [0x100cbf64], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10045bc0
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x100cbf54]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x10045b16
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x10045b89
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x10045b50
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x10045b48
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x10045b89
mov edi, eax
cmp dword [ebp - 4], eax
je 0x10045b66
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x10045b9a
cmp dword [ebp - 4], eax
jne 0x10045b57
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x10045bc0
mov ebx, dword [0x100cbf60]
jmp 0x10045ac3
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x10045b89
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10046a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049825
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1005200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0x10
jb 0x10046aab
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10046ac9
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10046ab7
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.10046f10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10046ae6
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x10046c50
cmp dword [0x100cbf74], 0x71c71c7
jne 0x10046afd
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x100cbf70
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.10047d3f
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.100022d0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x100cbf74]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004ff90]
mov eax, dword [0x100cbf88]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1004ff90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x100cbf6c]
comiss xmm1, xmm0
jbe 0x10046bfd
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10048fe0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x100cbf88]
cmp eax, ecx
jae 0x10046bdf
cmp eax, 0x200
jae 0x10046bdd
shl eax, 3
cmp eax, ecx
jae 0x10046bdf
mov eax, ecx
push eax
call fcn.10046d70
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10046f10
mov ecx, dword [0x100cbf74]
mov edx, dword [eax]
jmp 0x10046c00
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x100cbf74], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x100cbf78]
mov dword [ebp - 0x10], eax
mov eax, dword [0x100cbf84]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x100cbf70]
jne 0x10046c34
mov dword [ecx + eax*8], edi
jmp 0x10046c46
cmp esi, edx
jne 0x10046c3d
mov dword [ecx + eax*8], edi
jmp 0x10046c4a
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10046c4a
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10046d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10046d9c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [0x100cbf70]
push eax
mov dword [ebp - 0xc], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x100cbf78
lea eax, [esi + esi]
push eax
call fcn.10043670
mov edi, dword [0x100cbf70]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword [0x100cbf84], eax
mov dword [0x100cbf88], esi
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x10046ee0
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
jb 0x10046dfa
mov esi, dword [edx]
mov dword [ebp - 4], esi
mov esi, dword [edx + 0x10]
mov ebx, 0x811c9dc5
xor edx, edx
mov dword [ebp - 0x10], esi
test esi, esi
je 0x10046e27
mov ecx, dword [ebp - 4]
mov eax, esi
movzx esi, byte [edx + ecx]
inc edx
xor esi, ebx
imul ebx, esi, 0x1000193
cmp edx, eax
jb 0x10046e10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
and ebx, dword [0x100cbf84]
mov edx, dword [0x100cbf78]
lea ebx, [edx + ebx*8]
mov edx, dword [ebx]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
cmp edx, ecx
jne 0x10046e4c
mov dword [ebx], edi
mov dword [ebx + 4], edi
jmp 0x10046ed4
mov esi, dword [ebx + 4]
lea eax, [esi + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.10046fa0
test al, al
jne 0x10046e8f
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, edi
je 0x10046e8a
mov esi, dword [edi + 4]
mov ebx, dword [ebp - 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ecx
mov ecx, dword [ecx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov dword [ebx + 4], edi
jmp 0x10046ed1
mov ebx, esi
cmp dword [ebp - 4], esi
je 0x10046eb1
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.10046fa0
test al, al
je 0x10046ee9
cmp dword [ebp - 4], esi
jne 0x10046e96
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp eax, ecx
jne 0x10046de4
nop
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x10046ed1
Function at 0x10047030
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10047070
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x100472a0
push 0
push 0
mov dword [0x100cbe94], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100cbe90], eax
mov eax, 1
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x10047081
push eax
push dword [0x100cbe90]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x4018b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret

Function at 0x4018d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetTempPathA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jb 0x40190b
mov eax, dword [ebp + 0xc]
push eax
call fcn.004018b0
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401919
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.004047a0
add esp, 4
push str._temp_
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401570
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401959
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.00402000
add esp, 8
mov byte [eax], 0
mov esp, ebp
pop ebp
ret

Function at 0x401960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
push 1
call dword [sym.imp.kernel32.dll_SleepEx]
push 1
push 1
call dword [sym.imp.kernel32.dll_SleepEx]
mov eax, dword [0x406070]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x406070]
mov dl, byte [ecx + 0xf]
mov byte [ebp - 4], dl
jmp 0x4019f3
call fcn.00401993
mov dword [ebp - 8], 0x5f8
jmp 0x4019b3
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4019da
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx], dl
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x4019aa
push 0x5f8
mov eax, dword [0x406070]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.msvcrt.dll_memmove
add esp, 0xc
jmp 0x4019f5
jmp 0x40199c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024c0
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
and eax, 1
test eax, eax
je 0x4024e3
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
pop ebp
ret