joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449124
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44915c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44913d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44914c
or bl, 4
test esi, 0x20000000
je 0x449157
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44f804
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44f816
add esp, 0xfffffff0
call fcn.004034dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fb9c
mov eax, dword [0x484980]
mov dword [eax + 4], ebx
mov dword [eax], 0x44fba8
mov eax, dword [0x484990]
mov dword [eax + 4], ebx
mov dword [eax], 0x44fbb4
mov eax, ebx
call fcn.0044fbc0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44bfdc
push eax
push 0
push 0
mov eax, dword [0x484bf8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4215c0]
call fcn.00422a04
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4215c0]
call fcn.00422a04
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4215c0]
call fcn.00422a04
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044ffe0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44febc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44febc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44febc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44f953
call fcn.00403534
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44fca0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44fe4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44fe2c
mov dl, 1
mov eax, dword [0x416914]
call fcn.00403188
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040f4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44fe1b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043dcd4
test al, al
je 0x44fe0e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44fe5c
lea eax, [ebp - 0x254]
call fcn.00409464
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44fe0e
xor eax, eax
push ebp
push 0x44fe07
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44fe94
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44fdf0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404364
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44fdf0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404364
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fe0e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44fd11
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b730
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fe52
lea eax, [ebp - 0x260]
call fcn.004040f4
ret

Function at 0x450780
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x485bbc]
cmp byte [eax + 0xa5], 0
jne 0x4507f1
cmp dword [0x485bd4], 0
jne 0x4507b2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45073c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x485bd4], eax
cmp dword [0x485bd0], 0
jne 0x4507cd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x485bd0], eax
cmp dword [0x485bd8], 0
jne 0x4507f1
push esp
push 0
push 0
push 0x4506e0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x485bd8], eax
pop edx
ret
Function at 0x4508e8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4508ff
add esp, 0xfffffff0
call fcn.004034dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041fb9c
mov eax, dword [0x484bcc]
cmp word [eax + 2], 0
jne 0x450927
mov eax, dword [0x484bcc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451e7c
mov eax, dword [0x484d10]
cmp word [eax + 2], 0
jne 0x450941
mov eax, dword [0x484d10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452074
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416104]
call fcn.00403188
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421d70]
call fcn.004279b8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x450ac8
mov eax, dword [0x484a44]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427d88
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x452614
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x484a44]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cc7c
test eax, eax
je 0x450a36
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408e44
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cca4
test eax, eax
je 0x450a4a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404364
mov eax, dword [0x484814]
cmp byte [eax], 0
jne 0x450a7e
mov eax, ebx
call fcn.00450bf0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004527f0
mov eax, ebx
call fcn.004531b4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x450abe
call fcn.00403534
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450e70
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x485bbc]
cmp dword [eax + 0x30], 0
je 0x450f1a
cmp dword [ebx + 0x94], 0
jne 0x450f14
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450e00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x450f14
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x450eda
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x450f14
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004189b8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450ee9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x451a7c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x451ab1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041e4
jmp 0x451abe
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404148
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4529cc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452a0d
mov eax, esi
call fcn.004394dc
test al, al
je 0x452a0d
mov eax, dword [ebx + 0x84]
call fcn.0043927c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452a0d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043927c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45badc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x45bae4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x45bcd6
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x45bcec
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404148
lea ecx, [ebp - 0x10]
mov edx, 0x45bd00
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404148
lea ecx, [ebp - 0x14]
mov edx, 0x45bd18
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404148
lea ecx, [ebp - 0x18]
mov edx, 0x45bd34
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404148
lea ecx, [ebp - 0x1c]
mov edx, 0x45bd50
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404148
lea ecx, [ebp - 0x24]
mov edx, 0x45bd68
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004084e8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408900
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x45bd80
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x28]
call fcn.00458984
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x45bd90
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x2c]
call fcn.00458984
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x45bda8
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408900
inc eax
je 0x45bc79
lea ecx, [ebp - 0x34]
mov edx, 0x45bda8
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x34]
call fcn.004088c4
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409db4
fstp qword [ebp - 0x3c]
wait
call fcn.0040a118
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x45bc94
lea ecx, [ebp - 0x40]
mov edx, 0x45bda8
mov eax, esi
call fcn.0045986c
mov eax, dword [ebp - 0x40]
call fcn.00458984
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x45bdb8
mov eax, esi
call fcn.0045986c
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bcdd
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404118
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404118
ret
Function at 0x467f94
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x467fee
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00467f84
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004574f4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004570f4
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467ff5
lea eax, [ebp - 4]
call fcn.004040f4
ret

Function at 0x143a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0143a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x143a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x143a06a
add dl, dl
jne 0x143a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x143a0dc
xor eax, eax
add dl, dl
jne 0x143a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x143a17d
add dl, dl
jne 0x143a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x143a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x143a075
mov eax, 1
add dl, dl
jne 0x143a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x143a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x143a0e1
sub eax, ebx
mov ebx, 1
jne 0x143a128
mov ecx, 1
add dl, dl
jne 0x143a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x143a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x143a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x143a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x143a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x143a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x143a136
cmp eax, 0x7d00
jae 0x143a16d
cmp eax, 0x500
jb 0x143a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x143a075
cmp eax, 0x7f
ja 0x143a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x143a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x143a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x143a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003230
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d64b5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10105ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10003110
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100032c3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xccccccc
je 0x1000341f
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100ab93c
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e0720]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100e0720]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100033c1
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.100bcb90
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.100abcf0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100033a3
cmp ebx, 0x200
jae 0x100033a1
shl ebx, 3
cmp ebx, ecx
jae 0x100033a3
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10005af0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10003110
mov edx, dword [eax]
jmp 0x100033c4
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x100033ef
mov dword [ecx + eax*8], esi
jmp 0x100033fe
cmp edi, edx
jne 0x100033f8
mov dword [ecx + eax*8], esi
jmp 0x10003402
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10003402
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10094441
int3
Function at 0x10003c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10105ec0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x200], 0xf
push 0
movups xmmword [ebp - 0x214], xmm0
push eax
mov byte [ebp - 0x214], 0
mov dword [ebp - 0x1fc], 0
call fcn.100acff0
push 0x1f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100b8036
mov ecx, dword [ebp - 0x200]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x10003d0b
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003d01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003d63
push ecx
push edx
call fcn.100ab96c
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.10006b10
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100bcac1
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x1010af58
push 0x1f8
push eax
push dword [0x10105278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100abc94
mov esp, ebp
pop ebp
ret
call fcn.100b7a6f
int3

Function at 0x10003de0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10105ec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x1010aedc]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x10003e4c
xorps xmm0, xmm0
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
pop edi
mov dword [ebx + 0x14], 0xf
pop esi
mov byte [ebx], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100abc94
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x10003e14
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call fcn.100ad310
add esp, 0xc
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 0x20]
push esi
call fcn.10003080
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, ebx
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [ebx], xmm0
pop esi
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.100abc94
mov esp, ebp
pop ebp
ret
Function at 0x100044f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d65f5
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10105ec0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov eax, dword [esi + 0x5f8]
test eax, eax
je 0x10004543
push dword [esi]
push eax
push str._p____p
call fcn.10003c60
add esp, 0xc
mov eax, dword [0x1010af4c]
inc eax
mov dword [0x1010af4c], eax
cmp eax, 0x9c4
jl 0x10004569
push str.too_many_hooks:_cant_insert
call fcn.10003c60
add esp, 4
xor al, al
jmp 0x100046e1
test edi, edi
je 0x10004586
cmp byte [edi], 0
je 0x10004586
push 0x3b
push edi
lea eax, [esi + 0x1d0]
push 0x3c
push eax
call fcn.100b8036
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0xa08
lea eax, [ebp - 0x28]
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10075350
mov ecx, eax
add esp, 0xa10
cmp dword [ecx + 0x14], 7
jbe 0x100045b5
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x43c]
push ecx
push 0x1f4
lea eax, [esi + 0x20c]
push eax
call fcn.100b7b70
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10003940
imul eax, dword [0x1010af4c], 0xac8
sub esp, 0xa08
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
add eax, dword [0x1010af48]
mov ecx, eax
call fcn.10007140
test al, al
jne 0x1000467c
mov eax, dword [ebp - 0x43c]
lea ecx, [ebp - 0x28]
add eax, 0x20c
push eax
call fcn.10003560
push 0xfde9
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100739f0
add esp, 0xc
cmp dword [eax + 0x14], 0xf
mov byte [ebp - 4], 1
jbe 0x1000463e
mov eax, dword [eax]
push eax
push str.failed_to_insert_hook__s
call fcn.10003c60
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.100038f0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10003940
imul ecx, dword [0x1010af4c], 0xac8
add ecx, dword [0x1010af48]
call fcn.10006ef0
xor al, al
jmp 0x100046e1
mov esi, dword [ebp - 0x43c]
lea edx, [ebp - 0x428]
mov dword [ebp - 0x438], 4
mov dword [ebp - 0x42c], 0
mov eax, dword [esi]
lea ecx, [esi + 0x20c]
mov dword [ebp - 0x430], eax
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [ecx + edx - 2], ax
test ax, ax
jne 0x100046b0
push 0
push 0x1010af58
push 0x3f8
lea eax, [ebp - 0x438]
push eax
push dword [0x10105278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100abc94
mov esp, ebp
pop ebp
ret