joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a4a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45a4c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045ce6b
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x45a4ec
test byte [esp + 8], 2
je 0x45a4ec
call fcn.0045cede
mov dword [eax], 0xd
call fcn.0045cee7
mov dword [eax], 5
jmp 0x45a4c5
xor eax, eax
ret
Function at 0x470c70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00459290
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x470d3b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x470d3b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x470cee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x470cf9
or bh, 8
and edi, 0x8000000
je 0x470d14
mov eax, dword [0x50b95c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x470d3b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x471110
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x47113b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x47115f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x47117a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x473030
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x47304a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x47304a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x474c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00476610
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x474c53
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.0045c594
mov edx, dword [ebp - 4]
push edx
call fcn.00472fd0
push esi
push eax
call fcn.0045c610
add esp, 0x14
test eax, eax
je 0x474c8f
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00476830
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473090
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x474cf9
push 0
call fcn.004737c0
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x474ce7
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.004737c0
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x474cc8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x474d71
test edi, edi
je 0x474d6a
mov bl, byte [edi]
push 0
call fcn.004737c0
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x474d3d
cmp bl, 0x31
jne 0x474d32
push 0
call fcn.004737c0
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x474d3d
cmp byte [edi], 0x30
jne 0x474d71
cmp byte [edi + 2], 0x39
jge 0x474d71
test edi, edi
je 0x474d6a
push 0
call fcn.004737c0
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.0045cba5
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00472df0
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x474dbf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00476800
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x474db8
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x474dfc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004767b0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004766b0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00476590
mov edx, dword [ebp - 4]
push edx
call fcn.00475320
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481ed0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x481f00
push esi
call fcn.004823d0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x481ef9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x481f83
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x481f6f
mov eax, dword [esi + 8]
test eax, eax
je 0x481f24
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x481f6b
cmp eax, 2
je 0x481f6f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x481f17
cmp eax, 3
je 0x481f4a
cmp eax, 1
jne 0x481f17
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x481f17
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x481f17
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00481fb0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x481fa3
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00481fb0
add esp, 4
pop esi
ret
Function at 0x4b2ac0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b2af8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b1ac4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b1a9b
jmp 0x4b2b04
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b4409
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b444b
call fcn.004c432d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b444b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4442
xor eax, eax
jmp 0x4b4453
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4459
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bb995
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4cd368
call fcn.00459198
push ecx
push ecx
push esi
push 0x10
call fcn.004b1bda
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4bb9e2
mov ecx, esi
call fcn.004b6bc1
mov eax, dword [0x4ffb78]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004b179d
jmp 0x4bb9e4
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x4ea1d0
push eax
mov dword [ebp - 0x10], esi
call fcn.0045a7ef
pop esi
Function at 0x10508
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push 0x10352
mov dword [0x10b08], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [0x10b04], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [section..data], eax
push esi
lea eax, [ebp + 0xc]
push eax
mov dword [0x10b14], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
call edi
test al, al
je 0x10555
xor cl, cl
call dword [sym.imp.HAL.dll_KfRaiseIrql]
call edi
test al, al
je 0x1055f
xor eax, eax
jmp 0x10589
push esi
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1f03ff
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [0x10b14]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x499e68
Capabilities:
Query environment variable

Disassembly:
jmp 0x5b3147
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x5b315b
xor edi, edi
jmp 0x5b319f
push ebx
push esi
call fcn.005b3040
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.0049c13b
mov edi, eax
add esp, 0x14
test edi, edi
je 0x5b318c
push ebx
push esi
push edi
call fcn.0049c3fc
add esp, 0xc
push 2
push 0
call fcn.0049b9d4
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x49bb87
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5cd930
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x61dd48], 1
jge 0x5cd99f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x5cd975
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x5cd975
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5cd952
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5cd98b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x5cd992
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x5cda8f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x5cda60
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x5cda55
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x5cda49
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x5cda50
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x5cda8f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x5cda8a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x5cda73
mov eax, dword [ebx + 8]
jmp 0x5cda8f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x5cda81
xor eax, eax
jmp 0x5cda8f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x5cd9bf
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1003cb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e7008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1003cba3
cmp byte [esi + 0x3d], 0
je 0x1003cba3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003cb58
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1003cb6a
sub eax, 1
je 0x1003cb6e
sub eax, 2
je 0x1003cba3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c4f7f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1003cb8c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003cb58
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c4f7f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100c4f7f
mov esp, ebp
pop ebp
ret
Function at 0x1003ea30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c71d0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100e7008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x101d978c]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x101d978c]
mov dword [eax + 4], eax
mov dword [0x101d9790], 0
cmp ecx, dword [0x101d978c]
je 0x1003ea99
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.100c54bb
add esp, 8
mov ecx, esi
cmp esi, dword [0x101d978c]
jne 0x1003ea82
push 8
mov ecx, 0x101d9788
call fcn.1002e1b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x101d016c]
test ecx, ecx
je 0x1003ebf7
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x1003ebf7
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1003eae0
xor edx, edx
test eax, eax
je 0x1003eb01
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1003eaf0
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x101d9794]
and edx, dword [0x101d97a0]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x101d978c]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x1003eb68
mov ecx, edx
jmp 0x1003eb6c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003eb80
cmp dword [eax + 8], ebx
je 0x1003eb7c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x1003eb60
mov ecx, eax
jmp 0x1003eb84
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x1003ebdf
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.10042a00
mov edx, dword [0x101d9790]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x1003ec09
lea ecx, [edx + 1]
mov dword [0x101d9790], ecx
mov ecx, 0x101d9788
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x101d978c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100427e0
mov eax, dword [ebp - 0x20]
jmp 0x1003ebe6
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1003ead0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x1003f3b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c72b8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100e7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x101b1b78], 0x10
mov ecx, 0x101b1b64
mov edx, dword [0x101b1b74]
cmovae ecx, dword [0x101b1b64]
push 7
push str.invalid
call fcn.10042730
add esp, 8
test al, al
jne 0x1003f53b
cmp dword [0x101b1b80], 0x20a89
je 0x1003f53b
cmp byte [0x101b1b7c], al
je 0x1003f53b
mov ecx, dword [0x101d0174]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003f522
movss xmm0, dword [0x101b0284]
mulss xmm0, dword [0x100dae4c]
push ecx
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_roundf]
fstp dword [ebp - 0x14]
cvttss2si eax, dword [ebp - 0x14]
xor ecx, ecx
add esp, 4
mov edx, str.eax__rtt:__ims
test eax, eax
cmovle eax, ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10042300
add esp, 4
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
mov ecx, 0x101d4aec
push eax
call fcn.100b3b70
mov ecx, dword [0x101b0298]
mov edx, 0xa
sub ecx, dword [ebp - 0x1c]
sub ecx, 0x14
push ecx
mov eax, esp
mov dword [eax], 0x828c6ef0
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xa
push eax
call fcn.100b34f0
mov edx, dword [0x101b0298]
lea eax, [ebp - 0x34]
add esp, 0xc
add edx, 0xfffffff1
push 1
push eax
push ecx
mov eax, esp
mov ecx, 0x101d4aec
push 0xa
push edx
mov dword [eax], 0xfab4a0f0
call fcn.100b3920
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x1003f522
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003f518
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003f518
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100c54bb
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c4f7f
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1003f550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x101d0174]
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push esi
push edi
mov eax, dword [eax + 0x14]
push 0x101b029c
push 0x101b0298
call eax
call fcn.100b9a90
call fcn.100917f0
call fcn.1003ec20
cmp byte [0x101cc8c4], 0
je 0x1003f705
mov ecx, dword [0x101d0174]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003f705
mov ecx, dword [0x101d01fc]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1003f705
nop
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x1003f5d6
xor edx, edx
test ecx, ecx
je 0x1003f5fc
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003f5e3
cmp edi, 0x5ff56dc5
je 0x1003f60d
inc ebx
cmp ebx, dword [esp + 0x14]
jae 0x1003f705
mov ecx, dword [esp + 0x10]
jmp 0x1003f5c0
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + ebx*4]
test ebx, ebx
je 0x1003f705
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x1003f705
movss xmm1, dword [0x100dacf0]
xor edx, edx
cmp esi, 4
jl 0x1003f6d2
mov eax, dword [ebx + 0x7c]
lea edi, [esi - 4]
shr edi, 2
inc edi
lea ecx, [eax + 0x838]
lea edx, [eax + 0x1078]
lea eax, [edi*4]
mov dword [esp + 0x14], eax
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003f67c
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003f68f
mov dword [ecx], 0x7f7fffff
movss xmm0, dword [edx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003f6aa
mov dword [edx - 0x420], 0x7f7fffff
movss xmm0, dword [edx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003f6bd
mov dword [edx], 0x7f7fffff
add ecx, 0x1080
add edx, 0x1080
sub edi, 1
jne 0x1003f661
mov edx, dword [esp + 0x14]
cmp edx, esi
jge 0x1003f705
imul ecx, edx, 0x420
add ecx, 0x418
add ecx, dword [ebx + 0x7c]
sub esi, edx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003f6fa
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub esi, 1
jne 0x1003f6e7
call fcn.1003f3b0
call fcn.10093390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret