joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e6e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movss xmm0, dword [0x4573c4]
sub esp, 0x42c
movss dword [0x457380], xmm0
movss xmm0, dword [0x4573c4]
subss xmm0, dword [0x44c730]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
movss dword [0x4573c4], xmm0
call fcn.00406ec0
cmp eax, 0x8000
jbe 0x40e9ac
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.00418db0
mov esi, eax
call fcn.0040ccd0
movzx ecx, al
and ecx, 0x80000003
jns 0x40e74b
dec ecx
or ecx, 0xfffffffc
inc ecx
add ecx, 7
lea eax, [ebp - 0x11c]
push ecx
add eax, esi
push eax
call fcn.00404c70
push 5
push 0x32f
call fcn.0040bcd0
mov edx, eax
mov dword [ebp - 4], eax
add esp, 0x14
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x40e773
push edi
lea edi, [ebp - 0x11c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40e784
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
push 0x19f
call fcn.0040bcd0
mov cx, word [0x45738c]
mov esi, eax
movsx edx, word [0x457210]
movss xmm0, dword [0x457270]
push dword [ebp - 4]
movsx ecx, cx
sub edx, ecx
sub edx, 0x719ae3ae
push 5
movd xmm1, edx
cvtdq2ps xmm1, xmm1
addss xmm0, xmm1
movss dword [0x457270], xmm0
dec word [0x45738c]
dec word [0x457210]
call fcn.00404960
movss xmm0, dword [0x4570c4]
lea eax, [ebp - 0x11c]
subss xmm0, dword [0x44d088]
push esi
push eax
movss dword [0x4570c4], xmm0
call fcn.0041cbe7
push esi
push 3
mov edi, eax
call fcn.00404960
add esp, 0x20
test edi, edi
je 0x40e9aa
push edi
push 1
mov ecx, ebx
call fcn.00406ec0
push eax
mov ecx, ebx
call fcn.00404d70
push eax
call fcn.0041cd9a
push edi
call fcn.0041c8bc
add esp, 0x14
mov ecx, ebx
call fcn.00410530
movsx eax, word [0x45755c]
mov byte [ebp - 0x120], 0
push 0x104
movd xmm2, eax
mov ax, word [0x457488]
mov ecx, dword [0x457408]
movss xmm0, dword [0x45713c]
cwde
add ecx, eax
cvtdq2ps xmm2, xmm2
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
subss xmm2, xmm1
cvttss2si eax, xmm2
mov word [0x45755c], ax
lea eax, [ebp - 0x224]
inc dword [0x457408]
push eax
push 0
call dword [0x459464]
push 0x15
push 0x25af
mov byte [ebp - 0x225], 0
call fcn.0040bcd0
push dword [0x459358]
mov esi, eax
lea eax, [ebp - 0x224]
push dword [0x459340]
push eax
push esi
lea eax, [ebp - 0x42c]
push 0x207
push eax
call fcn.0041d105
push esi
push 0x15
call fcn.00404960
push dword [0x459358]
call fcn.00418550
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0040fe80
push 0x208
lea eax, [ebp - 0x42c]
push 0
push eax
call fcn.0041da40
add esp, 0x40
lea eax, [ebp - 0x224]
push 0x105
push 0
push eax
call fcn.0041da40
add esp, 0xc
push 0x15f90
call dword [0x4594c0]
movss xmm1, dword [0x45754c]
mov eax, dword [0x4574c8]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss xmm0, dword [0x4572e8]
subss xmm1, dword [0x44ce64]
addss xmm0, xmm1
lea eax, [ebp - 0x11c]
movss dword [0x4572e8], xmm0
push eax
call dword [0x459410]
movsx eax, word [0x4572a4]
movzx ecx, word [0x457488]
add eax, 0xb8362f44
imul ecx, eax
mov word [0x457488], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416c20
Capabilities:
Terminate process

Disassembly:
movsd xmm0, qword [0x457330]
subsd xmm0, qword [0x44c8d8]
push dword [0x458e9c]
movsd qword [0x457330], xmm0
call fcn.004169e0
add esp, 4
push 1
call fcn.0041c350
int3

Function at 0x419700
Capabilities:
Hash data with md5

Disassembly:
movzx eax, word [0x457268]
imul eax, eax, 0x3c19c32
mov word [0x457268], ax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x42d1b2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x458170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041f6dc
mov dword [ebp - 0x14], eax
cmp dword [0x45a8e8], esi
jne 0x42d2a5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x42d232
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42d385
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42d385
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42d385
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45a8e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45a8ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45a8f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a8f8], eax
test eax, eax
je 0x42d2a2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45a8f4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x42d2ca
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42d2bd
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42d2df
push 4
pop eax
jmp 0x42d387
cmp dword [ebp - 0x14], esi
je 0x42d2df
push dword [0x45a8e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x42d2c4
mov eax, dword [0x45a8f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x42d33d
cmp dword [0x45a8f8], edi
je 0x42d33d
push eax
call ebx
push dword [0x45a8f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x42d33d
test eax, eax
je 0x42d33d
call ecx
test eax, eax
je 0x42d332
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x42d332
test byte [ebp - 8], 1
jne 0x42d33d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42d36d
mov eax, dword [0x45a8ec]
cmp eax, edi
je 0x42d36a
push eax
call ebx
test eax, eax
je 0x42d36a
call eax
mov esi, eax
test esi, esi
je 0x42d36a
mov eax, dword [0x45a8f0]
cmp eax, edi
je 0x42d36a
push eax
call ebx
test eax, eax
je 0x42d36a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45a8e8]
call ebx
test eax, eax
je 0x42d385
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42d387
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e0ed
mov esp, ebp
pop ebp
ret
Function at 0x806028
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x80602e
pop ebp
sub ebp, 6
sub ebp, 0x406028
jmp 0x80608c
jmp 0x806095
mov eax, 0x406028
add eax, ebp
add eax, 0x93
mov ecx, 0x634
mov edx, 0x50a88f6
xor byte [eax], dl
inc eax
dec ecx
jne 0x8060ac
jmp 0x8060bf
pushfd
mov dh, 0x9e
mul dh
div dh
sahf
idiv byte [edx]
invalid
Function at 0x401550
Capabilities:
Encode data using xor

Disassembly:
push 0x40173c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub eax, 0x118d6070
or eax, dword [ecx + 0x54218e4f]
jb 0x40155e
fistp qword [edx + 0xc9]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x76], dh
arpl word [eax], ax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
add byte [edx], cl
add eax, 0x5a3983f2
dec edi
mov esp, 0x60287bff
cmp eax, 0xae48c87f
retf 0xdb41

Function at 0x405030
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x401356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 8], esp
mov dword [ebp - 4], 0x401340
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call fcn.00404f60
cmp ax, 0xffff
jne 0x40508f
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
push 0x4028b0
push ecx
call edi
push eax
push 0x80000002
jmp 0x4050aa
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x24]
push 0x4028b0
push eax
call edi
push eax
push 0x80000001
call fcn.00401f5c
mov esi, eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
cmp esi, ebx
jne 0x405121
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaLenBstr]
mov edx, dword [esi]
push eax
lea eax, [ebp - 0x28]
push edx
push eax
call edi
push eax
push 1
push ebx
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x24]
mov ecx, dword [ebx]
push ecx
push edx
call edi
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00401fa4
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
mov ecx, dword [ebp - 0x24]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaStrToUnicode]
push ecx
push ebx
call edi
mov edx, dword [ebp - 0x28]
push edx
push esi
call edi
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x24]
push eax
push ecx
push 2
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStrList]
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call fcn.00401fe8
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x40514c
jmp 0x40514b
ret
Function at 0x422c00
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x422c8e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x422c4c
push 0
push str.tabukojugacefofehevugijumapo_lezegiyoritatureguhikihubumuw_xaxeharufutogokurulumifadasovac_vubecifuwibugawiculedodov_cezotoburosuhipijavor
call edi
push str.fidodekodinifobuyox
push str.mayuretubayazihexe
push str.fetodidibamonasuyifiluhib
push str.vizuzecizeyasufuhizosusi
call ebx
push 0
call ebp
call fcn.00422b50
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422c84
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.lavenoxatorav
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422c22
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x422caa
mov dword [0x434908], 0xa62e7790
mov dword [0x43490c], 0xffffffff
ret
Function at 0x423070
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x4348fc]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x434564], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x4230ba
push 0
push str.gajaracuvegipozatoxesom
call esi
push str.kimezufiyutodojaxejuweg
push 0
push 0
call edi
mov eax, dword [0x4348fc]
dec ebp
jne 0x423090
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x4230e2
push 0
push 0
call edi
mov eax, dword [0x4348fc]
cmp esi, 0x846373
jne 0x4230f9
mov eax, dword [0x432ad0]
add eax, 0xa231
mov dword [0x4348fc], eax
cmp eax, 0x141
jne 0x423110
mov dword [0x434138], ebp
mov dword [0x43413c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x4230d0
call fcn.00422cf0
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x423b47
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423b75
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423b93
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423ab1
jmp 0x423b93
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423b93
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00423ab1
test edi, edi
mov eax, edi
jne 0x423b7d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x438c24]
test ecx, ecx
je 0x423c46
jmp 0x423b46
ret 8

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x401a76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43114c]
jne 0x401a80
repz ret
jmp fcn.0040252b

Function at 0x40b01e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43114c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040409b
and dword [ebp - 0x14], 0
cmp dword [0x433cf8], 0
mov dword [ebp - 0x18], eax
jne 0x40b0d1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b179
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b179
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x433cf8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433cfc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433d00], eax
call edi
push eax
call esi
mov dword [0x433d08], eax
test eax, eax
je 0x40b0d1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x433d04], eax
mov eax, dword [0x433d04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b12a
cmp dword [0x433d08], ecx
je 0x40b12a
push eax
call esi
push dword [0x433d08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b12a
test ebx, ebx
je 0x40b12a
call edi
test eax, eax
je 0x40b121
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b121
test byte [ebp - 8], 1
jne 0x40b12a
or dword [ebp + 0x10], 0x200000
jmp 0x40b15d
mov eax, dword [0x433cfc]
cmp eax, dword [ebp - 0x18]
je 0x40b15d
push eax
call esi
test eax, eax
je 0x40b15d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b15d
mov eax, dword [0x433d00]
cmp eax, dword [ebp - 0x18]
je 0x40b15d
push eax
call esi
test eax, eax
je 0x40b15d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433cf8]
call esi
test eax, eax
je 0x40b179
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b17b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a76
leave
ret
Function at 0x422a50
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x422ae3
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x422a9c
push 0
push str.tabukojugacefofehevugijumapo_lezegiyoritatureguhikihubumuw_xaxeharufutogokurulumifadasovac_vubecifuwibugawiculedodov_cezotoburosuhipijavor
call edi
push str.fidodekodinifobuyox
push str.mayuretubayazihexe
push str.fetodidibamonasuyifiluhib
push str.vizuzecizeyasufuhizosusi
call ebx
push 0
call ebp
call fcn.004229a0
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422ad9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422a72
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x422aff
mov dword [0x434a08], 0xa62e7790
mov dword [0x434a0c], 0xffffffff
ret
Function at 0x422ea0
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x4349fc]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x434664], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x422eea
push 0
push str.gajaracuvegipozatoxesom
call esi
push str.kimezufiyutodojaxejuweg
push 0
push 0
call edi
mov eax, dword [0x4349fc]
dec ebp
jne 0x422ec0
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x422f12
push 0
push 0
call edi
mov eax, dword [0x4349fc]
cmp esi, 0x846373
jne 0x422f29
mov eax, dword [0x432ad0]
add eax, 0xa231
mov dword [0x4349fc], eax
cmp eax, 0x141
jne 0x422f40
mov dword [0x434238], ebp
mov dword [0x43423c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x422f00
call fcn.00422b40
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10
Function at 0x10001f80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100483c5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10052040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10002300
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1000200c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1014de5c], 0xfffffff
jne 0x10002023
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1014de58
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.1004734e
mov ecx, dword [edi]
mov esi, eax
mov edx, dword [edi + 4]
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov ecx, dword [0x1014de5c]
mov edi, dword [0x1014de70]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, edi
addsd xmm0, qword [eax*8 + 0x1004f550]
cvtdq2pd xmm1, xmm1
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1004f550]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x1014de54]
comiss xmm2, xmm1
jbe 0x100020f9
divss xmm0, xmm1
call fcn.10001190
call fcn.10048250
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100020db
cmp edi, 0x200
jae 0x100020d9
shl edi, 3
cmp edi, ecx
jae 0x100020db
mov edi, ecx
push edi
call fcn.10002180
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10002300
mov ecx, dword [0x1014de5c]
mov edx, dword [eax]
jmp 0x100020fc
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1014de5c], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1014de6c]
mov ecx, dword [0x1014de60]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1014de58]
jne 0x1000212d
mov dword [ecx + eax*8], esi
jmp 0x1000213c
cmp ebx, edx
jne 0x10002136
mov dword [ecx + eax*8], esi
jmp 0x10002140
cmp dword [ecx + eax*8 + 4], edi
jne 0x10002140
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002180
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100021ac
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1014de58]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1014de60
lea eax, [edi + edi]
push eax
call fcn.10001e80
mov eax, dword [0x1014de58]
lea ebx, [edi - 1]
mov dword [0x1014de6c], ebx
mov dword [0x1014de70], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100022e6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1014de60]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x10002244
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100022b1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000227e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x10002276
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100022b1
cmp ebx, edx
je 0x1000228e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100022c2
cmp ebx, edx
jne 0x10002282
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100022e6
mov ebx, dword [0x1014de6c]
jmp 0x100021f2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100022b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4