joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8d0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x420534]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40c9a6
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c910
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404eb0
push 0
push esi
call fcn.0040deb0
add esp, 8
test al, al
je 0x40c9a6
push str..net
push esi
call fcn.0040af00
push 0
push esi
call fcn.0040deb0
add esp, 0x10
test al, al
je 0x40c968
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411126
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40c972
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40c98c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c9a6
push 0
push esi
call fcn.0040deb0
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411126
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.00411126
mov esp, ebp
pop ebp
ret
Function at 0x40d500
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x40d51b
mov eax, dword [esi]
mov edi, dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test ebx, ebx
jne 0x40d569
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x40d560
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d551
movzx eax, ax
or eax, 0x80070000
push eax
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.0040a570
add esp, 0xc
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411163
add esp, 4
push ebx
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40d5bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40d5a3
movzx eax, ax
or eax, 0x80070000
push eax
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.0040a570
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40d5c0
sub edx, ecx
mov ecx, esi
sar edx, 1
push edx
push ebx
call fcn.00404eb0
push ebx
call fcn.0041116c
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, reloc.glu32.dll_gluQuadricTexture
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x100085e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000860c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000862e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10008630
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100086b5
jg 0x10008645
test esi, esi
je 0x100086b5
test ecx, ecx
jl 0x1000868e
jg 0x1000864f
test eax, eax
je 0x1000868e
cmp edi, ecx
jg 0x10008663
jl 0x10008659
cmp esi, eax
jae 0x10008663
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10008691
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100086b5
jg 0x1000869b
test esi, esi
je 0x100086b5
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100086b5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100086d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x100086fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000871e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10008720
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x100087c0
jg 0x1000873d
test esi, esi
je 0x100087c0
test ecx, ecx
jl 0x1000878a
jg 0x10008747
test eax, eax
je 0x1000878a
cmp ebx, ecx
jg 0x1000875b
jl 0x10008751
cmp esi, eax
jae 0x1000875b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10008791
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x100087c0
jg 0x1000879b
test esi, esi
je 0x100087c0
cmp dword [edi + 0x4c], 0
je 0x100087c0
mov ecx, edi
call fcn.100090a0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10008b60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10008b90
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10008b90
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10008c65
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10008bb9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10008bc5
movsx eax, bl
jmp 0x10008bfc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10008c65
cmp eax, 1
jle 0x10008c26
cmp eax, 3
jne 0x10008c65
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10008c44
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10008c65
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10008c65
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10069076
mov esp, ebp
pop ebp
ret 4
Function at 0x100090d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10009173
cmp byte [esi + 0x3d], 0
je 0x10009173
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10009128
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000913a
sub eax, 1
je 0x1000913e
sub eax, 2
je 0x10009173
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000915c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009128
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10069076
mov esp, ebp
pop ebp
ret

Function at 0x10019570
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x14], 0x10
push ebx
jb 0x10019589
mov ecx, dword [ecx]
mov edx, ecx
lea ecx, [ebp - 0x1c]
call fcn.1001ad30
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.10008ff0
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10069076
mov esp, ebp
pop ebp
ret
Function at 0x10019d80
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bd22
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x98
mov eax, dword [0x100c400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x94], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x98], eax
jb 0x10019e17
mov edx, dword [eax]
mov dword [ebp - 0x98], edx
mov ecx, dword [eax + 0x10]
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], 0x67452301
mov dword [ebp - 0x8c], 0xefcdab89
mov dword [ebp - 0x88], 0x98badcfe
mov dword [ebp - 0x84], 0x10325476
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
cmp ecx, 0x400
jbe 0x10019eca
lea esi, [ecx - 0x401]
shr esi, 0xa
inc esi
xor edi, edi
nop word [eax + eax]
push 0x400
add edx, edi
lea ecx, [ebp - 0x90]
call fcn.1001a6f0
mov ecx, dword [ebp - 0x94]
add esp, 4
mov edx, dword [ebp - 0x98]
sub ecx, 0x400
add edi, 0x400
mov dword [ebp - 0x94], ecx
sub esi, 1
jne 0x10019e80
mov dword [ebp - 0x94], edi
mov edi, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x90]
lea edx, [eax + edx]
call fcn.1001a6f0
add esp, 4
lea ecx, [ebp - 0x90]
call fcn.1001a7b0
xor eax, eax
mov dword [ebp - 0x94], eax
movzx eax, byte [ebp + eax - 0x7c]
push eax
lea eax, [ebp - 0x34]
push str._02x
push eax
call fcn.1001ac00
lea esi, [ebp - 0x34]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10019f12
mov edx, dword [edi + 0x14]
sub esi, ecx
mov ecx, dword [edi + 0x10]
mov eax, edx
sub eax, ecx
cmp esi, eax
ja 0x10019f55
lea eax, [ecx + esi]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x10019f38
mov eax, dword [edi]
lea edi, [eax + ecx]
push esi
lea eax, [ebp - 0x34]
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov byte [edi + esi], 0
add esp, 0xc
mov edi, dword [ebp - 0x9c]
jmp 0x10019f6f
push esi
lea eax, [ebp - 0x34]
mov byte [ebp - 0x98], 0
push eax
push dword [ebp - 0x98]
mov ecx, edi
push esi
call fcn.1000e770
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp eax, 0x10
jb 0x10019ef5
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10069076
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001e640
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c247
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc
push esi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
movups xmm0, xmmword [ebx + 0xc]
lea ecx, [esi + 4]
mov dword [esi], vtable.spdlog::pattern_formatter.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmmword [ecx], xmm0
mov byte [ebx + 0xc], 0
movq xmm0, qword [ebx + 0x1c]
movq qword [ecx + 0x10], xmm0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
movups xmm0, xmmword [ebx + 0x24]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
movups xmmword [esi + 0x1c], xmm0
mov byte [ebx + 0x24], 0
movq xmm0, qword [ebx + 0x34]
movq qword [esi + 0x2c], xmm0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0xf
mov eax, dword [ebx + 8]
mov dword [esi + 0x34], eax
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [esi + 0x38], xmm0
push ecx
movups xmmword [esi + 0x48], xmm0
mov ecx, esi
mov dword [esi + 0x58], 0
call fcn.1001ecb0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x1001e772
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e768
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001e768
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100696b3
add esp, 8
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov byte [ebx + 0xc], 0
cmp edx, 0x10
jb 0x1001e7ba
mov ecx, dword [ebx + 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e7b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001e7b0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100696b3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x34
Function at 0x1001e910
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c2ac
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 4]
mov dword [esi], vtable.spdlog::pattern_formatter.0
push 2
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x100b5a54
mov byte [ecx], 0
call fcn.10007d50
movups xmm0, xmmword [ebx + 0xc]
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
movups xmmword [esi + 0x1c], xmm0
mov byte [ebx + 0xc], 0
movq xmm0, qword [ebx + 0x1c]
movq qword [esi + 0x2c], xmm0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xf
mov dword [esi + 0x34], 0
lea edi, [esi + 0x68]
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 3
xorps xmm0, xmm0
movups xmmword [esi + 0x38], xmm0
push 0x128
movups xmmword [esi + 0x48], xmm0
mov dword [esi + 0x58], 0
call fcn.1006933d
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], esi
push 0x128
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, esi
push 0
push 0
call fcn.1001e0a0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 5
mov ecx, dword [edi + 4]
cmp dword [edi + 8], ecx
je 0x1001ea42
mov dword [ecx], eax
add dword [edi + 4], 4
jmp 0x1001ea5b
lea eax, [ebp - 0x18]
push eax
push ecx
mov ecx, edi
call fcn.10023d00
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1001ea5b
mov eax, dword [ecx]
push 1
call dword [eax]
lea ecx, [ebp - 0x14]
call fcn.10020fd0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x1001ea99
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001ea8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001ea8f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100696b3
add esp, 8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x1c
Function at 0x1001fd30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c608
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x100c400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x1c], ebx
cmp dword [ebx + 0x14], 0x10
jb 0x1001fd6d
mov esi, dword [ebx]
mov edi, dword [eax + 0x94]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x1001fd9b
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x1001fd80
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x94]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xa8]
and eax, edx
mov ecx, dword [ecx + 0x9c]
mov dword [ebp - 0x20], ecx
mov esi, dword [ecx + eax*8]
add eax, eax
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
cmp eax, edi
jne 0x1001fdcc
mov eax, edi
jmp 0x1001fdd1
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x1001fe41
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x1001fddf
mov edx, dword [ebx]
mov ebx, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x2c], ebx
cmp ebx, 0x10
mov ebx, dword [ebp - 0x1c]
jb 0x1001fdf3
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x18], eax
call fcn.1000f180
add esp, 8
test al, al
jne 0x1001fe18
mov esi, dword [esi]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
jmp 0x1001fdc4
cmp dword [ebp - 0x2c], 0x10
lea eax, [esi + 8]
jb 0x1001fe23
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x1001fe2d
mov ecx, dword [ebx]
push dword [ebp - 0x18]
mov edx, dword [ebx + 0x10]
push eax
call fcn.1000f180
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp - 0x14]
cmp edi, dword [eax + 0x94]
jne 0x1001fe60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
lea ecx, [ebp - 0x68]
call fcn.1001cb50
sub esp, 0x14
mov dword [ebp - 4], 0
mov ecx, esp
mov edx, eax
push str._already_exists
call fcn.10009ae0
add esp, 4
lea ecx, [ebp - 0x50]
call fcn.1001d4e0
push 0x100c1b80
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3