joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b32d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x46c008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0xc8]
test ecx, ecx
je 0x434e17
mov edx, dword [ebx + 0xcc]
test edx, edx
je 0x434e17
mov eax, dword [ecx]
push 0
push edx
push ecx
call dword [eax + 0x28]
push 1
mov ecx, ebx
call fcn.00433c90
mov edx, 0x198
lea ecx, [ebp - 0x20]
call fcn.0040f3c0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 2
push dword [ebx + 4]
call edi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.0042c020
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call fcn.0044a6fb
add esp, 4
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
lea ecx, [ebp - 0x50]
call fcn.00432360
lea esi, [ebx + 0x200]
mov dword [ebp - 4], 1
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
lea edi, [ebx + 0x1d0]
mov eax, dword [ebx + 0x1c8]
lea ecx, [ebp - 0x50]
push edi
mov dword [ebp - 0x10], eax
call fcn.0040a4c0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040a4c0
add edi, 0x18
lea ecx, [ebp - 0x38]
push edi
call fcn.0040a4c0
lea eax, [edi + 0xc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a4c0
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x40], 0
je 0x434f63
cmp dword [ebp - 0x4c], 0
mov byte [ebx + 0x21b], 1
jne 0x434f32
push 0x46294c
lea ecx, [ebp - 0x50]
call fcn.0040a530
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x434f99
cmp byte [ebx + 0x156], 0
jne 0x434f99
mov ecx, ebx
mov byte [ebx + 0x155], 1
call fcn.00435830
jmp 0x434fa4
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x434f4a
mov byte [ebx + 0x21b], 1
cmp dword [ebp - 0x28], eax
je 0x434f99
cmp dword [ebp - 0x34], eax
jne 0x434f88
push 0x46294c
lea ecx, [ebp - 0x38]
call fcn.0040a530
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
push dword [ebp - 0x2c]
call fcn.0044a6fb
push dword [ebp - 0x38]
call fcn.0044a6fb
push dword [ebp - 0x44]
call fcn.0044a6fb
push dword [ebp - 0x50]
call fcn.0044a6fb
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435c40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x435c72
cmp dword [edx + 8], 0xffffff65
jne 0x435c72
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x435cb8
sub eax, 0x14
je 0x435c7b
sub eax, 2
je 0x435cb8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x435c72
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 2
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
mov dword [ebp - 0x1c], 2
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x435c72
mov ecx, esi
call fcn.00435ce0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x436550
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x46c008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x46e2d1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x4365b5
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.0040a940
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.0044a6fb
add esp, 4
mov eax, esi
jmp 0x4365d7
mov eax, dword [0x46e408]
test eax, eax
je 0x4365d7
push 0x4010
push 0x2b4
lea edx, [esp + 0x20]
or esi, 0x80
push edx
push esi
push ecx
call eax
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret 4

Function at 0x4369e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x46c008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x461b04
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret
Function at 0x437670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b770
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x46c008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], 0
mov dword [esi], vtable.CExtractCallbackImp.4.0
mov dword [esi + 4], vtable.CExtractCallbackImp.3.0
mov dword [esi + 8], vtable.CExtractCallbackImp.2.0
mov dword [esi + 0xc], vtable.CExtractCallbackImp.1.0
mov dword [esi + 0x10], vtable.CExtractCallbackImp.0
push 8
mov dword [esi + 0x18], 0
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 3
mov word [eax], cx
mov dword [ebp - 4], ecx
push 8
mov dword [esi + 0x28], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 3
mov word [eax], cx
mov byte [ebp - 4], 1
push 8
mov dword [esi + 0x34], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 3
mov word [eax], cx
mov byte [ebp - 4], 2
mov word [esi + 0x40], 1
mov dword [esi + 0x50], ecx
mov word [esi + 0x54], cx
push 8
mov dword [esi + 0x58], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 3
mov word [eax], cx
mov byte [ebp - 4], 3
push 8
mov dword [esi + 0x64], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 3
mov word [eax], cx
mov byte [ebp - 4], 4
push 8
mov dword [esi + 0x70], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 3
mov word [eax], cx
mov byte [ebp - 4], 5
push 8
mov dword [esi + 0x7c], ecx
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 3
mov word [eax], cx
mov byte [ebp - 4], 6
mov dword [esi + 0x88], ecx
push 8
call fcn.0044a831
xor ecx, ecx
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 3
mov word [eax], cx
mov byte [ebp - 4], 7
push 8
mov dword [esi + 0x94], ecx
call fcn.0044a831
mov dword [esi + 0x94], eax
add esp, 0x24
xor ecx, ecx
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 3
mov word [eax], cx
mov eax, esi
mov word [esi + 0xa0], cx
mov byte [esi + 0xa2], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov dword [ebp - 0x84], 0x420041
xor edx, edx
mov dword [ebp - 0x80], 0x440043
mov dword [ebp - 0x7c], 0x460045
mov dword [ebp - 0x78], 0x480047
mov dword [ebp - 0x74], 0x4a0049
mov dword [ebp - 0x70], 0x4c004b
mov dword [ebp - 0x6c], 0x4e004d
mov dword [ebp - 0x68], 0x50004f
mov dword [ebp - 0x64], 0x520051
mov dword [ebp - 0x60], 0x540053
mov dword [ebp - 0x5c], 0x560055
mov dword [ebp - 0x58], 0x580057
mov dword [ebp - 0x54], 0x5a0059
mov dword [ebp - 0x50], 0x620061
mov dword [ebp - 0x4c], 0x640063
mov dword [ebp - 0x48], 0x660065
mov dword [ebp - 0x44], 0x680067
mov dword [ebp - 0x40], 0x6a0069
mov dword [ebp - 0x3c], 0x6c006b
mov dword [ebp - 0x38], 0x6e006d
mov dword [ebp - 0x34], 0x70006f
mov dword [ebp - 0x30], 0x720071
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x760075
mov dword [ebp - 0x24], 0x780077
mov dword [ebp - 0x20], 0x7a0079
mov dword [ebp - 0x1c], 0x310030
mov dword [ebp - 0x18], 0x330032
mov dword [ebp - 0x14], 0x350034
mov dword [ebp - 0x10], 0x370036
mov dword [ebp - 0xc], 0x390038
mov dword [ebp - 8], 0x2f002b
test esi, esi
jle 0x43877d
nop dword [eax]
movzx ecx, word [edi + edx*2]
xor eax, eax
cmp word [ebp + eax*2 - 0x84], cx
je 0x438778
inc eax
cmp eax, 0x40
jb 0x438756
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret
inc edx
cmp edx, esi
jl 0x438750
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret
Function at 0x438850
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b90d
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x4c], ecx
lea esi, [ecx + 0x80]
mov dword [ebp - 0x5c], 0
push esi
push 0x461320
mov dword [ebp - 0x54], esi
call fcn.004025a0
mov edi, eax
mov dword [ebp - 0x60], edi
test edi, edi
je 0x438a24
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 0
lea esi, [edi + 0x80]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push esi
call fcn.0044b640
mov eax, dword [0x46c888]
add esp, 0xc
mov edx, esi
mov dword [edi], eax
mov ecx, edi
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
push dword [ebp - 0x4c]
mov dword [edi + 0x20], 0x6a09e667
mov dword [edi + 0x24], 0xbb67ae85
mov dword [edi + 0x28], 0x3c6ef372
mov dword [edi + 0x2c], 0xa54ff53a
mov dword [edi + 0x30], 0x510e527f
mov dword [edi + 0x34], 0x9b05688c
mov dword [edi + 0x38], 0x1f83d9ab
mov dword [edi + 0x3c], 0x5be0cd19
call fcn.00409380
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
mov ecx, edi
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.00409430
push ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x6c]
call fcn.0044a360
push dword [ebp - 0x54]
mov byte [ebp - 4], 1
push 0
push edi
call fcn.0044bbc0
add esp, 0xc
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x48]
call fcn.004387d0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x43897b
mov eax, dword [eax]
push 0x40
push eax
push dword [ebp - 0x58]
call fcn.0044b640
mov byte [ebp - 4], 1
add esp, 0xc
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x4389c1
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4389b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438a39
push edx
push ecx
call fcn.0044a823
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6c]
test ecx, ecx
je 0x4389f5
mov edx, dword [ebp - 0x64]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4389eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x438a3e
push edx
push ecx
call fcn.0044a823
add esp, 8
mov dword [ebp - 4], 3
push dword [edi - 4]
call fcn.0044f27e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret 8
push 0x46a740
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 1
push eax
call fcn.0044d691
call fcn.0044f7d7
call fcn.0044f7d7
int3
Function at 0x438a50
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0
push eax
mov esi, edx
call fcn.0044bbc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x438ae6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x438ae6
mov ecx, dword [esi]
jmp 0x438af8
mov eax, dword [ebp - 0x210]
xor ecx, ecx
add ecx, ebx
mov dword [esi], ecx
adc eax, 0
mov dword [esi + 4], eax
push ecx
mov dword [ebp - 0x218], 0
call fcn.0044a831
mov ecx, dword [ebp - 0x214]
add esp, 4
push 0
mov dword [ecx], eax
lea ecx, [ebp - 0x218]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret
Function at 0x449e90
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ba10
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x46e3dc], eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x449ef1
cmp dword [ebp - 0x98], 2
jne 0x449ef1
mov al, 1
jmp 0x449ef3
xor al, al
mov byte [0x46e2d1], al
call fcn.0043d7d0
test al, al
jne 0x449f08
xor eax, eax
jmp 0x44a039
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x449f45
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x449f45
push 0xc00
call eax
test eax, eax
jne 0x449fd3
push 0x106
lea eax, [ebp - 0x2e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
je 0x449fd3
cmp edi, 0x104
ja 0x449fd3
cmp word [ebp + edi*2 - 0x2e6], 0x5c
je 0x449f7e
mov eax, 0x5c
mov word [ebp + edi*2 - 0x2e4], ax
inc edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, str.userenv
nop dword [eax]
mov cl, byte [esi]
test cl, cl
je 0x449fd3
lea eax, [ebp - 0x2e4]
lea eax, [eax + edi*2]
nop
inc esi
test cl, cl
jne 0x449fc6
xor ecx, ecx
mov dword [eax], 0x64002e
push 8
mov dword [eax + 4], 0x6c006c
mov word [eax + 8], cx
lea eax, [ebp - 0x2e4]
push ecx
push eax
call ebx
jmp 0x449f90
movzx ecx, cl
mov word [eax], cx
add eax, 2
mov cl, byte [esi]
jmp 0x449fa0
call fcn.00437860
jmp 0x44a039
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044a6ed
mov esp, ebp
pop ebp
ret 0x10

Function at 0x44fc86
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44fcc5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44fcc5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44fcc5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44fcc5
cmp dword [ecx + 0x74], 0xe
jbe 0x44fcc5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x451a90
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e47c
push 0x45e474
push str.FlsAlloc
push 0x1f
call fcn.0045196c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x451ac4
push dword [ebp + 8]
mov ecx, esi
call dword [0x45c308]
call esi
jmp 0x451aca
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x451b0e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e48c
push 0x45e484
push str.FlsGetValue
push 0x21
call fcn.0045196c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x451b45
push dword [ebp + 8]
mov ecx, esi
call dword [0x45c308]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x451b4d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45e494
push 0x45e48c
push str.FlsSetValue
push 0x22
call fcn.0045196c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x451b87
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45c308]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x453122
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4531bf
push ebx
push esi
call fcn.004530eb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00451699
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x45316c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4531be
push edi
push eax
call fcn.004517a8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x45318c
call fcn.0045176e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4531bd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00451699
add esp, 0x20
test eax, eax
jne 0x4531ab
push edi
call fcn.0045176e
jmp 0x4531b3
push ebx
call fcn.0045176e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10003c3d
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x10003e14
cmp dword [0x100eb340], 0
jne 0x10003e0d
push ebx
push ebp
push edi
call fcn.10004526
mov ebx, eax
test ebx, ebx
jne 0x10003c80
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x10003dee
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x100eb340
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x10003e0d
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x100eb340]
jmp 0x10003e16
xor eax, eax
add esp, 0x74
ret
Function at 0x10004b60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ba8d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100e6f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10004a40
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10004bf3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xccccccc
je 0x10004d4f
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100aaa5f
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c8fb0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c8fb0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10004cf1
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.msvcrt.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100aaab0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10004cd3
cmp ebx, 0x200
jae 0x10004cd1
shl ebx, 3
cmp ebx, ecx
jae 0x10004cd3
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100074b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10004a40
mov edx, dword [eax]
jmp 0x10004cf4
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10004d1f
mov dword [ecx + eax*8], esi
jmp 0x10004d2e
cmp edi, edx
jne 0x10004d28
mov dword [ecx + eax*8], esi
jmp 0x10004d32
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10004d32
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1009333d
int3