joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed6d6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x5ed6f2
xor eax, eax
jmp 0x5ed797
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x5ed707
inc dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x5ed732
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + ecx]
mov al, byte [edx + 0x5f4500]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
jmp 0x5ed704
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov dword [ebp - 4], 0
jmp 0x5ed762
inc dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x5ed78d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + ecx]
mov al, byte [edx + 0x5f43f8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov byte [ecx + edx], al
jmp 0x5ed75f
mov eax, 1
jmp 0x5ed797
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5ed88b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax], 0xffffffff
jne 0x5ed8a4
xor eax, eax
jmp 0x5ed8f0
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 1
je 0x5ed8be
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 2
jne 0x5ed8ce
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x5ed8e6
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
sub eax, 0x40
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, 1
jmp 0x5ed8f0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5eda46
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
nop
leave
add esp, 4
popal
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
pushal
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x5eda82
inc dword [ebp - 0xc]
mov eax, dword [0x5f6588]
cmp dword [ebp - 0xc], eax
jge 0x5edab7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x5f6c48]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x5edab2
jmp 0x5edab7
jmp 0x5eda7f
mov eax, dword [0x5f6588]
cmp dword [ebp - 0xc], eax
jl 0x5edae1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.005ed029
add esp, 8
mov dword [ebp - 0x10], 1
jmp 0x5edb11
cmp dword [0x5f40e4], 0
jne 0x5edb02
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
mov dword [ebp - 0x10], eax
jmp 0x5edb11
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x5edee6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
nop
leave
add esp, 4
popal
leave
add esp, 4
push ebp
mov ebp, esp
sub esp, 0x20
pushal
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
jmp 0x5edf2e
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
shl eax, 2
cmp dword [eax + eax*4 + 0x5f4648], 0xffffffff
je 0x5edf62
mov eax, dword [ebp - 0x1c]
shl eax, 2
mov ecx, dword [ebp - 0x18]
cmp dword [eax + eax*4 + 0x5f4648], ecx
jne 0x5edf5d
jmp 0x5edf62
jmp 0x5edf2b
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x1c]
shl eax, 2
lea eax, [eax + eax*4]
add eax, 0x5f4648
push eax
call fcn.005ed461
add esp, 0x18
test eax, eax
je 0x5edfb6
cmp dword [ebp - 4], 0
je 0x5edfb1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
shl ecx, 2
add dword [ecx + ecx*4 + 0x5f464c], eax
jmp 0x5edfd3
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 0x14

Function at 0x5f025d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
jne 0x5f0285
xor eax, eax
leave
ret
mov eax, dword [ebp - 0x84]
xor ecx, ecx
sub eax, ecx
je 0x5f02b9
dec eax
je 0x5f0299
dec eax
je 0x5f02ab
jmp 0x5f0281
cmp dword [ebp - 0x8c], ecx
jne 0x5f02a5
push 4
jmp 0x5f02bb
jbe 0x5f02ab
push 5
jmp 0x5f02bb
cmp dword [ebp - 0x90], 5
sbb eax, eax
add eax, 7
leave
ret
push 3
pop eax
leave
ret

Function at 0x5f2ed1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x14], esi
jle 0x5f2f03
push ebx
push edi
mov edi, dword [ebp + 8]
sub edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
push 4
pop ebx
lea ecx, [eax + esi]
mov eax, esi
cdq
idiv ebx
mov al, byte [edx + ebp + 0x10]
xor al, byte [ecx + edi]
inc esi
cmp esi, dword [ebp + 0x14]
mov byte [ecx], al
jl 0x5f2ee4
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x10002ef6
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x10002f17
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x10002f0e
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x10002f06
mov eax, ebx
leave
ret

Function at 0x10002f3d
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x10002f9c
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x10002fc9
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x10002fb8
xor ecx, eax
xor edx, ebx
dec edi
jne 0x10002fa9
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x10002fef
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x10002f90
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x1000382f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword ds:[ebp - 0x20], 0xff8bff8b
mov dword ds:[ebp - 0x14], 0xff8bff8b
mov dword ds:[ebp - 0x1c], 0xff8bff8b
push 0x7fc
push dword [ebp - 0x20]
call fcn.10002ebc
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ebx, eax
pop ecx
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x10003a0e
push dword [ebp - 4]
call fcn.10002ea0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100038ff
jmp 0x10003a0e
push dword [ebp - 4]
call fcn.10002ea0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [ebp - 4], eax
jne 0x10003953
lea eax, [ebp - 4]
push eax
call fcn.10003815
mov dword [ebp - 0x28], eax
push 0
push 4
push dword [ebp - 0x28]
push dword [ebp - 4]
push 0xffffffff
push dword [ebp - 0x14]
call fcn.100030c7
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10003953
mov eax, 1
jmp 0x10003955
xor eax, eax
test eax, eax
je 0x10003a03
push ebx
push esi
push edx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
lea eax, [eax + 0x78]
mov eax, dword [eax]
lea esi, [eax + ebx]
mov dword [ebp - 0x10], esi
lea edx, [esi + 0x20]
mov edx, dword [edx]
add edx, ebx
mov edx, dword [edx]
add edx, ebx
mov dword [ebp - 0x18], edx
lea eax, [esi + 0x18]
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], eax
pop ebx
pop esi
pop edx
push dword [ebp - 4]
lea eax, [ebp - 4]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x100039fb
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [ebp - 0x1c]
call fcn.10003632
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100039ea
push edi
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
lea eax, [eax + 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 8]
lea eax, [eax + edi*4]
mov eax, dword [eax]
add eax, dword [ebp + 8]
pop edi
leave
ret 8
push dword [ebp - 0xc]
call fcn.100037ee
add dword [ebp - 8], eax
pop ebx
pop ecx
pop edx
inc ecx
jmp 0x1000399d
add esp, 0xc
jmp 0x10003a0e
pop ebx
pop ecx
pop edx
add ecx, 4
jmp 0x100038d8
add esp, 0xc
mov edi, edi
mov edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0
jmp 0x10003a2f
mov esp, ebp
pop ebp
ret 8

Function at 0x1000cf90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000cfae
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000cfa3
pop esi
ret
Function at 0x403fc0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d79b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x44c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x404190
lea eax, [ebp - 0x234]
push eax
push 4
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404190
mov eax, dword [ebp - 0x234]
mov ecx, 4
shr eax, 2
mul ecx
mov esi, eax
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.0042bd83
mov edi, eax
add esp, 4
test edi, edi
je 0x404071
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x404073
xor edi, edi
mov dword [ebp - 0x240], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x234]
push edi
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404183
xor esi, esi
test dword [ebp - 0x234], 0xfffffffc
jbe 0x404183
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [edi + esi*4]
push ebx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402000
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 7
push 0
mov byte [ebp - 4], 1
lea ecx, [eax + eax]
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x238]
push eax
call fcn.00404bd0
mov ecx, dword [ebp - 0x238]
push 0
push 2
push 0x440640
call fcn.00404bd0
mov ecx, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x404171
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404167
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4041ac
push ecx
push edx
call fcn.0042bd75
add esp, 8
mov eax, dword [ebp - 0x234]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4040b0
test edi, edi
je 0x404190
push edi
call fcn.0042bd8c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042bc1d
mov esp, ebp
pop ebp
ret
call fcn.0042cf30
int3
Function at 0x40b200
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43df75
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x44c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00408b80
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x40b293
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x40b3e1
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.0042bd45
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4428c0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4428c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x40b383
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.0042c020
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x40b365
cmp ebx, 0x200
jae 0x40b363
shl ebx, 3
cmp ebx, ecx
jae 0x40b365
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.00414220
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408b80
mov edx, dword [eax]
jmp 0x40b386
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x40b3b1
mov dword [ecx + eax*8], esi
jmp 0x40b3c0
cmp edi, edx
jne 0x40b3ba
mov dword [ecx + eax*8], esi
jmp 0x40b3c4
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40b3c4
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0042a295
int3
Function at 0x40ef80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e560
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x44c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0042bd45
mov edi, eax
add esp, 4
test edi, edi
je 0x40f02d
push 1
mov dword [ebp - 4], 0
call fcn.0042a4b1
add esp, 4
mov dword [edi + 4], eax
jmp 0x40f02f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.004031d0
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x44cae8]
mov ecx, dword [0x44caec]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ff60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e76d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x44c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.00406dc0
mov edi, eax
cmp edi, 0x44cb28
je 0x40fff7
mov esi, dword [0x44cb28]
mov ecx, 0x44cb28
push dword [esi + 4]
push 0x44cb28
call fcn.00408630
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov ecx, dword [0x44cb28]
mov dword [0x44cb2c], 0
mov eax, dword [edi]
mov dword [0x44cb28], eax
mov eax, dword [edi + 4]
mov dword [edi], ecx
mov ecx, dword [0x44cb2c]
mov dword [0x44cb2c], eax
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
lea eax, [ebp - 0x18]
push eax
mov ecx, eax
call fcn.00408630
push 0x40
push dword [ebp - 0x18]
call fcn.0042bd75
add esp, 8
lea ecx, [ebp - 0x20]
push dword [ebp - 0x10]
call fcn.0040f0d0
mov cl, byte [0x44cb18]
mov al, byte [ebp - 0x20]
mov edx, dword [0x44cb20]
mov esi, dword [0x44cb24]
mov byte [ebp - 0x10], cl
mov byte [0x44cb18], al
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x20], cl
mov ecx, dword [ebp - 0x14]
mov dword [0x44cb20], eax
mov dword [0x44cb24], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00415dc0
cmp dword [ebp + 0x1c], 7
lea eax, [ebp + 8]
mov byte [ebp - 4], 0
cmova eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.Luna_Start
push edi
call esi
push str.Luna_EmbedSettings
push edi
mov dword [0x44cb00], eax
call esi
push str.Luna_Inject
push edi
mov dword [0x44cb08], eax
call esi
push str.Luna_useembed
push edi
mov dword [0x44cb04], eax
call esi
push str.Luna_embedcallback
push edi
mov dword [0x44cb0c], eax
call esi
push 0
push 0x64
push 0
push 0
mov dword [0x44cb10], eax
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 0x406a90
push 0x406ad0
push 0
push 0
push 0
push 0
push 0x406ac0
push 0x406a80
mov dword [0x44cb14], eax
call dword [0x44cb00]
mov ecx, dword [ebp + 0x1c]
add esp, 0x24
cmp ecx, 7
jbe 0x410135
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41012b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41014b
push ecx
push edx
call fcn.0042bd75
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
call fcn.0042cf30
int3
Function at 0x412360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
push esi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x44cb38
xor eax, edx
imul esi, eax, 0x1000193
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00408b80
mov edx, dword [eax + 4]
test edx, edx
je 0x412412
mov ecx, dword [0x44cb50]
mov eax, dword [0x44cb44]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x4123ec
cmp eax, edx
jne 0x4123e4
mov eax, dword [0x44cb3c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4123f4
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x4123f4
cmp eax, edx
jne 0x4123f4
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [0x44cb40]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.0042bd75
add esp, 8
push 0
push 1
push dword [0x44cb14]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
pop esi
mov esp, ebp
pop ebp
ret 4