joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100863d0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
movss dword [esp], xmm1
mov eax, dword [ecx + 0x2c]
test eax, eax
jle 0x100865f5
movss dword [esp + 0x14], xmm0
mov dword [esp + 0x10], ecx
mov esi, dword [ecx + 0xc]
mov ecx, dword [0x10258f60]
mov edx, dword [ecx + 0x18fc]
movss xmm1, dword [ecx + 0x1900]
movaps xmm0, xmm1
divss xmm0, dword [edx + 0x10]
movups xmmword [esp + 0x2c], xmm0
lea edi, [esi + eax*2]
mov dword [esp + 0xc], edx
lea ecx, [edx + 0xc]
mov dword [esp + 8], ecx
xorps xmm0, xmm0
movaps xmm2, xmm1
addss xmm2, xmm0
movups xmmword [esp + 0x1c], xmm2
xor ebx, ebx
xorps xmm4, xmm4
mov dword [esp + 4], eax
mov dword [esp + 0x18], esi
nop
lea edx, [esi + ebx*2]
mov ebp, edx
xorps xmm6, xmm6
nop dword [eax + eax]
cmp ebp, edi
jae 0x100864a0
movzx ecx, word [ebp]
add ebp, 2
cmp ecx, 0xd
je 0x10086450
cmp ecx, 0xa
je 0x100864b0
lea esi, [ecx*4]
mov eax, dword [esp + 0xc]
add esi, dword [eax + 8]
cmp dword [eax], ecx
cmovle esi, dword [esp + 8]
movss xmm0, dword [esi]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 4]
mulss xmm0, dword [esp + 0x2c]
addss xmm6, xmm0
jmp 0x10086450
xorps xmm5, xmm5
xorps xmm0, xmm0
jmp 0x100864c6
xorps xmm5, xmm5
movaps xmm0, xmm6
cmpless xmm0, xmm5
andnps xmm0, xmm6
movups xmm5, xmmword [esp + 0x1c]
xorps xmm6, xmm6
sub ebp, edx
cmp ebp, 2
jl 0x100865f5
test ebx, ebx
jne 0x100864e6
movaps xmm7, xmm4
addss xmm7, dword [0x101a7780]
ucomiss xmm7, dword [esp]
ja 0x10086539
movaps xmm7, xmm5
cmpeqss xmm7, dword [0x101a7780]
movaps xmm2, xmm7
andps xmm2, xmm1
movss xmm3, dword [0x101ae354]
andnps xmm7, xmm3
orps xmm7, xmm2
xorps xmm2, xmm2
cmpltss xmm2, xmm6
movaps xmm3, xmm2
andnps xmm3, xmm7
andps xmm2, xmm1
orps xmm2, xmm3
addss xmm2, xmm5
addss xmm4, xmm2
sar ebp, 1
ucomiss xmm4, dword [esp]
ja 0x10086540
add ebx, ebp
cmp ebx, eax
jl 0x10086440
jmp 0x100865f5
xor eax, eax
jmp 0x100865f5
xorps xmm1, xmm1
movss xmm4, dword [esp + 0x14]
ucomiss xmm1, xmm4
jbe 0x10086555
mov eax, ebx
jmp 0x100865f5
maxss xmm6, xmm0
ucomiss xmm6, xmm4
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
jbe 0x100865e1
mov eax, dword [esp + 0x1c]
cmp ebx, eax
mov edi, eax
cmovg edi, ebx
cmp ebp, 2
mov edx, 1
cmovge edx, ebp
movss xmm0, dword [0x101a77b0]
mov eax, ebx
mov dword [esp], edi
nop dword [eax]
cmp edi, eax
je 0x10086611
movzx ecx, word [esi + eax*2]
movaps xmm2, xmm0
cmp ecx, 0xa
je 0x100865ce
mov dword [esp + 4], eax
mov edi, esi
lea esi, [ecx*4]
mov eax, dword [esp + 0xc]
add esi, dword [eax + 8]
cmp dword [eax], ecx
cmovle esi, dword [esp + 8]
movss xmm2, dword [esi]
mov esi, edi
mov edi, dword [esp]
mov eax, dword [esp + 4]
mulss xmm2, dword [esp + 0x2c]
movaps xmm3, xmm1
addss xmm3, xmm2
ucomiss xmm3, xmm4
ja 0x100865fd
inc eax
movaps xmm1, xmm3
dec edx
jne 0x10086590
add ebp, ebx
cmp dword [esp + 0x1c], ebp
jl 0x10086611
lea eax, [ebp - 1]
cmp word [esi + ebp*2 - 2], 0xa
cmovne eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mulss xmm2, dword [0x101a62c0]
addss xmm1, xmm2
ucomiss xmm1, xmm4
ja 0x100865f5
inc eax
jmp 0x100865f5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100869a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x10258d1c]
xor ecx, ebp
mov dword [esp + 0x58], ecx
movzx ecx, byte [eax]
jmp 0x100869e0
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086b15
cmp cl, 0x25
jne 0x100869d0
cmp byte [eax + 1], 0x25
je 0x100869d0
lea ebx, [esp + 0x18]
push esi
push edi
push eax
push 0x40
push ebx
call fcn.100485e0
add esp, 0x14
nop word cs:[eax + eax]
movzx ecx, byte [ebx]
inc ebx
cmp cl, 0x20
je 0x10086a10
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
cmp eax, 4
jne 0x10086a8f
dec ebx
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
add esp, 4
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [0x101aeda8]
ucomisd xmm0, xmm1
jae 0x10086a4b
xorpd xmm1, xmm1
subsd xmm0, xmm1
movsd qword [esp + 8], xmm0
setae al
fld qword [esp + 8]
fnstcw word [esp + 4]
movzx ecx, word [esp + 4]
or ecx, 0xc00
mov word [esp + 6], cx
fldcw word [esp + 6]
fistp qword [esp + 8]
fldcw word [esp + 4]
movzx esi, al
shl esi, 0x1f
xor esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
jmp 0x10086b15
xor eax, eax
cmp cl, 0x2d
sete al
xor edx, edx
cmp byte [ebx + eax - 1], 0x2b
sete dl
add edx, eax
mov ch, byte [ebx + edx - 1]
mov al, ch
add al, 0xd0
mov byte [esp + 3], al
mov eax, 0
mov esi, 0
cmp byte [esp + 3], 9
ja 0x10086aff
add ebx, edx
xor edx, edx
xor esi, esi
nop word cs:[eax + eax]
mov eax, edx
mov edx, 0xa
mul edx
mov edi, eax
movzx eax, ch
add esi, esi
lea esi, [esi + esi*4]
add eax, 0xffffffd0
add eax, edi
adc esi, edx
mov ch, byte [ebx]
mov byte [esp + 3], ch
add ch, 0xd0
inc ebx
mov edx, eax
cmp ch, 0xa
mov ch, byte [esp + 3]
jb 0x10086ad0
mov edi, eax
neg edi
mov edx, 0
sbb edx, esi
cmp cl, 0x2d
cmovne edi, eax
cmovne edx, esi
mov esi, edx
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.10155ad1
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10086b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
sub esp, 0x6c
movss xmm0, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
mov ecx, dword [0x10258d1c]
xor ecx, esp
mov dword [esp + 0x68], ecx
movzx ecx, byte [eax]
test cl, cl
je 0x10086c3e
mov edi, dword [esp + 0x7c]
jmp 0x10086b78
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086c3e
cmp cl, 0x25
jne 0x10086b60
cmp byte [eax + 1], 0x25
je 0x10086b60
cvtss2sd xmm0, xmm0
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], eax
lea esi, [esp + 0x28]
mov dword [esp], esi
mov dword [esp + 4], 0x40
call fcn.100485e0
nop word cs:[eax + eax]
movzx eax, byte [esi]
inc esi
cmp al, 0x20
je 0x10086bb0
and edi, 0xfffffffe
cmp edi, 4
jne 0x10086bd6
dec esi
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
fstp dword [esp + 0x18]
movss xmm0, dword [esp + 0x18]
jmp 0x10086c3e
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [esi + ecx - 1], 0x2b
sete dl
add edx, ecx
movzx ecx, byte [esi + edx - 1]
mov ah, cl
add ah, 0xd0
xorps xmm0, xmm0
cmp ah, 9
ja 0x10086c33
add esi, edx
movss xmm1, dword [0x101a79bc]
nop word cs:[eax + eax]
movzx ecx, cl
add ecx, 0xffffffd0
xorps xmm2, xmm2
cvtsi2ss xmm2, ecx
mulss xmm0, xmm1
addss xmm0, xmm2
movzx ecx, byte [esi]
mov edx, ecx
add dl, 0xd0
inc esi
cmp dl, 0xa
jb 0x10086c10
cmp al, 0x2d
jne 0x10086c3e
xorps xmm0, xmmword [0x101a77e0]
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
fstp xword [esp + 0x1c]
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10155ad1
fld xword [esp + 0x1c]
add esp, 0x6c
pop esi
pop edi
ret
Function at 0x10086c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
movsd xmm0, qword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x10258d1c]
xor ecx, ebp
mov dword [esp + 0x74], ecx
movzx ecx, byte [eax]
test cl, cl
je 0x10086d7f
mov edi, dword [ebp + 0xc]
jmp 0x10086cb8
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086d7f
cmp cl, 0x25
jne 0x10086ca0
cmp byte [eax + 1], 0x25
je 0x10086ca0
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], eax
lea esi, [esp + 0x34]
mov dword [esp], esi
mov dword [esp + 4], 0x40
call fcn.100485e0
nop word cs:[eax + eax]
movzx eax, byte [esi]
inc esi
cmp al, 0x20
je 0x10086cf0
and edi, 0xfffffffe
cmp edi, 4
jne 0x10086d16
dec esi
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
jmp 0x10086d7f
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [esi + ecx - 1], 0x2b
sete dl
add edx, ecx
movzx ecx, byte [esi + edx - 1]
mov ah, cl
add ah, 0xd0
xorpd xmm0, xmm0
cmp ah, 9
ja 0x10086d73
add esi, edx
movsd xmm1, qword [0x101af028]
nop word cs:[eax + eax]
movzx ecx, cl
add ecx, 0xffffffd0
xorps xmm2, xmm2
cvtsi2sd xmm2, ecx
mulsd xmm0, xmm1
addsd xmm0, xmm2
movzx ecx, byte [esi]
mov edx, ecx
add dl, 0xd0
inc esi
cmp dl, 0xa
jb 0x10086d50
cmp al, 0x2d
jne 0x10086d7f
xorpd xmm0, xmmword [0x101a63a0]
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0x28]
mov ecx, dword [esp + 0x74]
xor ecx, ebp
call fcn.10155ad1
fld xword [esp + 0x28]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x10087190
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp edx, 3
je 0x100871b7
cmp edx, 2
je 0x100871c5
mov al, 1
cmp edx, 1
jne 0x100871c4
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
ret

Function at 0x10087a90
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x1025e590]
test eax, eax
je 0x10087ad4
mov edi, ecx
xor ebx, ebx
mov ebp, 0x14
mov ecx, dword [0x1025e588]
nop word [eax + eax]
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
jne 0x10087adb
inc ebx
add ebp, 0x2c
cmp eax, ebx
jne 0x10087ac0
xor esi, esi
jmp 0x10087b9a
xor eax, eax
test edi, edi
setne al
lea ecx, [esp + 4]
mov edx, 0xffffffff
push eax
call fcn.10087de0
add esp, 4
mov eax, dword [0x1025e590]
xor esi, esi
cmp ebx, eax
jae 0x10087b40
mov ecx, dword [0x1025e588]
jmp 0x10087b18
inc ebx
add ebp, 0x2c
cmp ebx, eax
jae 0x10087b40
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
je 0x10087b10
mov ecx, ebx
mov edx, edi
call fcn.10088150
test eax, eax
jne 0x10087b3e
mov ecx, dword [0x1025e588]
mov eax, dword [0x1025e590]
jmp 0x10087b10
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x10087b9a
mov dword [esp], esi
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x10087b88
xor esi, esi
jmp 0x10087b65
inc esi
cmp ebp, esi
je 0x10087b88
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10087b60
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10087b60
push ebx
push 0
push dword [0x1025e584]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10155ad1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0xc], eax
mov esi, dword [0x1025e588]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
lea ecx, [esp + 8]
push ecx
push 0x40
mov dword [esp + 0xc], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100881d1
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp], ecx
je 0x100881d8
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
lea edx, [esp + 8]
je 0x100881fc
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100881fc
mov esi, 0xa
jmp 0x10088236
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
lea edx, [esp + 8]
jne 0x100881f2
movzx ecx, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x100881fc
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp]
movzx eax, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor esi, esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10155ad1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088270
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], edx
mov ebx, ecx
mov eax, dword [0x10258d1c]
xor eax, esp
mov dword [esp + 0x10], eax
xor esi, esi
mov ebp, 1
xor eax, eax
lock cmpxchg dword [0x1025e580], ebp
je 0x100882b8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp esi, 0x20
setae al
push eax
call edi
inc esi
xor eax, eax
lock cmpxchg dword [0x1025e580], ebp
jne 0x100882a0
cmp dword [0x1025e584], 0
je 0x10088301
test ebx, ebx
je 0x1008830b
mov ecx, dword [0x1025e590]
mov esi, 4
test ecx, ecx
je 0x100883a8
mov eax, dword [0x1025e588]
neg ecx
xor ebp, ebp
nop word cs:[eax + eax]
cmp dword [eax], ebx
je 0x1008831a
dec ebp
add eax, 0x2c
cmp ecx, ebp
jne 0x100882f0
jmp 0x100883a8
mov esi, 2
jmp 0x100883a8
mov ecx, dword [esp]
call fcn.10087a90
mov esi, eax
jmp 0x100883a8
cmp ebp, 1
je 0x100883a8
mov eax, dword [eax + 0x14]
shr eax, 1
and eax, 1
mov edi, dword [esp]
cmp eax, edi
jne 0x1008833c
xor esi, esi
cmp edi, 1
adc esi, 5
jmp 0x100883a8
neg ebp
lea ecx, [esp + 4]
mov edx, ebp
push 1
call fcn.10087de0
add esp, 4
mov ecx, ebp
mov edx, edi
call fcn.10088150
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x100883a8
mov eax, dword [esp + 0xc]
mov dword [esp], eax
test eax, eax
je 0x10088399
xor ebp, ebp
jmp 0x10088376
inc ebp
cmp dword [esp], ebp
je 0x10088399
push dword [ebx + ebp*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10088370
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10088370
push ebx
push 0
push dword [0x1025e584]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xchg dword [0x1025e580], eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10155ad1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100893b0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call sub.MSVCP140.dll__Thrd_hardware_concurrency
mov esi, eax
mov dword [0x1025e5f4], eax
push 0x14
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [0x1025e5f0], eax
test esi, esi
je 0x10088b30
xor esi, esi
xor eax, eax
nop word cs:[eax + eax]
mov ecx, dword [0x1025e5f0]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ecx + esi + 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
push 0x18
call fcn.10155a6b
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
call fcn.100893d0
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + esi]
mov edx, dword [ebp - 0x20]
mov dword [ecx + esi + 4], edx
mov dword [ecx + esi + 8], 0x1025e598
push 0
push 0
push eax
push 0x10088c00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x28]
inc eax
add esi, 0x14
cmp eax, dword [0x1025e5f4]
jb 0x10088ac0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10094c90
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x10094cd7
mov eax, dword [esi + 0x14]
sub eax, ecx
cmp eax, 0x1000
jb 0x10094cb8
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10094cfa
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.10155aa0
add esp, 8
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x10094cf8
lock dec dword [esi + 4]
jne 0x10094cf8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock dec dword [esi + 8]
jne 0x10094cf8
mov eax, dword [esi]
mov ecx, esi
pop esi
jmp dword [eax + 4]
pop esi
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x10126ee0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x20]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx edx, byte [ebx + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 3]
xor edx, eax
imul esi, edx, 0x1000193
and esi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov dword [esp], ecx
mov ecx, dword [ecx + 0xc]
lea edi, [esi + esi]
mov ebp, dword [ecx + edi*4 + 4]
xor eax, eax
mov dword [esp + 8], edx
cmp ebp, edx
je 0x10126ff1
lea edx, [esi + esi]
inc edx
mov dword [esp + 4], edi
mov esi, dword [ecx + edi*4]
mov edi, dword [ebx]
cmp edi, dword [ebp + 8]
jne 0x10126f5c
cmp esi, ebp
je 0x10126f8e
mov eax, dword [ebp + 4]
mov dword [ecx + edx*4], eax
jmp 0x10126f9e
mov ebx, ebp
nop
cmp ebx, esi
je 0x10126ff1
mov ebx, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jne 0x10126f60
cmp ebp, ebx
je 0x10126f8a
mov ebp, ebx
cmp esi, ebx
mov edx, dword [esp]
jne 0x10126fa1
mov eax, dword [esi]
mov edi, dword [esp + 4]
mov dword [ecx + edi*4], eax
mov ebp, esi
jmp 0x10126fa1
cmp esi, ebx
jne 0x10126f54
mov eax, dword [esp + 4]
mov esi, edx
mov edx, dword [esp + 8]
mov dword [ecx + eax*4], edx
mov dword [ecx + esi*4], edx
mov edx, dword [esp]
mov eax, dword [ebp]
dec dword [edx + 8]
mov ecx, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x54]
test ecx, ecx
je 0x10126fe1
mov eax, dword [ebp + 0x5c]
sub eax, ecx
cmp eax, 0x1000
jb 0x10126fd7
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10126ffb
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.10155aa0
add esp, 8
push 0x60
push ebp
call fcn.10155aa0
add esp, 8
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x101270d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10127940
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax]
movss xmm0, dword [ecx]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x20]
movzx ecx, word [ecx]
mov esi, dword [ebp + 0x24]
mov edi, dword [esi]
mov esi, dword [ebp + 0x1c]
mov byte [ebx + 4], 0
mov dword [ebx + 8], edi
xorps xmm1, xmm1
movups xmmword [ebx + 0xc], xmm1
movups xmmword [ebx + 0x1c], xmm1
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
mov word [ebx + 0x34], cx
lea ecx, [ebx + 4]
movups xmmword [ebx + 0x38], xmm1
mov dword [ebp - 0x20], ebx
movups xmmword [ebx + 0x48], xmm1
mov dword [ebp - 0x10], 0
mov dword [esp + 0xc], eax
movss dword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.100f04e0
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
Function at 0x101568a5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push 0x101f18a0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10156881
pop esi
leave
ret 8
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x62d224ce
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4b2f7a5c
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x614b58a4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4beb5522
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219