joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x164
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x2c]
mov byte [eax], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x40fc34
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x40fc34
push ebp
mov ebp, dword [ebx + 0x50]
push esi
xor eax, eax
cmp ebp, 1
push edi
je 0x40faec
cmp ebp, 3
je 0x40faec
cmp ebp, 4
jne 0x40fb2f
xor eax, eax
lea esi, [ebx + 0x5e0]
mov cl, byte [esi]
mov byte [esp + eax + 0x74], cl
inc eax
add esi, 4
cmp eax, 0x100
jb 0x40faf4
or eax, 0xffffffff
lea esi, [esp + 0x74]
mov edi, 0x100
xor edx, edx
mov dl, byte [esi]
xor edx, eax
and edx, 0xff
mov ecx, dword [edx*4 + 0x41a8c0]
shr eax, 8
xor eax, ecx
inc esi
dec edi
jne 0x40fb11
not eax
movzx ecx, byte [ebx + 0x49]
movzx edx, byte [ebx + 0x48]
push eax
mov eax, dword [ebx + 0x44]
push eax
movzx eax, byte [ebx + 0x3c]
push ecx
mov ecx, dword [ebx + 0x38]
push edx
mov edx, dword [ebx + 0x34]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
mov eax, dword [ebx + 0x30]
push ecx
mov ecx, dword [ebx + 0x4c]
push edx
mov edx, dword [ebx + 0x40]
push eax
mov eax, dword [ebx + 0x24]
push ecx
mov ecx, dword [ebx + 0x2c]
push ebp
push edx
push eax
push str._s__u__d__d:_dx_d__d__d__d__d__d__08X
push ecx
call esi
mov eax, dword [ebx + 0x50]
add esp, 0x38
cmp eax, 2
je 0x40fb86
cmp eax, 3
je 0x40fb86
cmp eax, 4
jne 0x40fc2a
fld qword [ebx + 0xa0]
fld qword [ebx + 0xa8]
fld qword [ebx + 0xb0]
fld qword [ebx + 0xb8]
fld qword [ebx + 0xc0]
fld qword [ebx + 0xc8]
fmul qword [0x41acc0]
call fcn.004022e0
fmul qword [0x41acc0]
push eax
call fcn.004022e0
fmul qword [0x41acc0]
push eax
call fcn.004022e0
fmul qword [0x41acc0]
push eax
call fcn.004022e0
fmul qword [0x41acc0]
push eax
call fcn.004022e0
fmul qword [0x41acc0]
push eax
call fcn.004022e0
push eax
lea edx, [esp + 0x28]
push 0x41ace0
push edx
call esi
lea eax, [esp + 0x30]
add esp, 0x20
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fc07
mov edi, dword [ebx + 0x2c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40fc14
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x20]
pop edi
inc eax
pop esi
mov dword [ebx + 0x20], eax
pop ebp
pop ebx
add esp, 0x164
ret
Function at 0x4115b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 8]
cmp eax, dword [esi + 0x40]
push edi
mov dword [esp + 0xc], eax
jge 0x4115ca
mov dword [esi + 0x40], eax
cmp eax, dword [esi + 0x48]
jle 0x4115d2
mov dword [esi + 0x48], eax
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
mov edx, dword [esi]
sub ecx, eax
sar ecx, 2
add eax, 4
push ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
push ebp
movsx ebp, word [eax]
movsx eax, word [eax + 2]
mov ebx, dword [esi]
cdq
mov edi, eax
mov eax, dword [esi + 4]
xor edi, edx
shr ebx, 0xa
sub edi, edx
cmp ebx, eax
jb 0x41161a
push ebx
mov ecx, esi
call fcn.0040f5e0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi]
mov eax, dword [esi + 0xc]
mov eax, dword [eax + ebx*4]
and edx, 0x3ff
mov dword [eax + edx*8], ebp
mov dword [eax + edx*8 + 4], edi
mov edx, dword [esi]
mov eax, dword [esi + 0x3c]
inc edx
cmp ebp, eax
mov dword [esi], edx
lea edi, [edi + ebp - 1]
jge 0x411642
mov dword [esi + 0x3c], ebp
cmp edi, dword [esi + 0x44]
jle 0x41164a
mov dword [esi + 0x44], edi
dec dword [esp + 0x10]
je 0x41165d
mov eax, dword [esp + 0x28]
add eax, 4
mov dword [esp + 0x28], eax
jmp 0x4115f4
mov edi, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
add esi, 0x14
shr edi, 8
cmp edi, eax
pop ebp
pop ebx
jb 0x41167b
push edi
mov ecx, esi
call fcn.0040f660
mov ecx, dword [esp + 0x14]
mov eax, dword [esi]
mov edx, dword [esi + 0xc]
mov edx, dword [edx + edi*4]
and eax, 0xff
lea eax, [eax + eax*2]
lea eax, [edx + eax*4]
mov edx, dword [esp + 0xc]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esi]
inc eax
pop edi
mov dword [esi], eax
pop esi
add esp, 0x14
ret 4
Function at 0x412030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x28]
mov edx, dword [eax + 0xc]
push esi
cmp edx, dword [ecx + 0x6c]
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
jge 0x41204c
mov dword [ecx + 0x6c], edx
cmp edx, dword [ecx + 0x74]
jle 0x412054
mov dword [ecx + 0x74], edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov edi, dword [ecx + 0x28]
push ebx
sub eax, edx
lea esi, [ecx + 0x28]
sar eax, 3
lea ebx, [edx + 8]
push ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x10], eax
lea ebx, [ebx]
movsx eax, word [ebx + 2]
movsx ebp, word [ebx]
mov dword [esp + 0x20], eax
cdq
mov edi, eax
mov eax, dword [ebx + 4]
xor edi, edx
sub edi, edx
push edi
push eax
call fcn.004116b0
mov ebx, dword [esi]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
shr ebx, 0xa
cmp ebx, eax
jb 0x4120b4
push ebx
mov ecx, esi
call fcn.0040f6e0
mov eax, dword [esi]
mov ecx, dword [esi + 0xc]
and eax, 0x3ff
lea edx, [eax + eax*2]
mov eax, dword [ecx + ebx*4]
lea ecx, [eax + edx*4]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [ecx], ebp
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov edx, dword [esi]
mov eax, dword [esp + 0x14]
inc edx
mov dword [esi], edx
cmp ebp, dword [eax + 0x68]
lea edi, [edi + ebp - 1]
jge 0x4120ec
mov dword [eax + 0x68], ebp
cmp edi, dword [eax + 0x70]
jle 0x4120f4
mov dword [eax + 0x70], edi
dec dword [esp + 0x10]
je 0x412110
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
add eax, 8
mov dword [esp + 0x38], eax
mov ebx, eax
jmp 0x412080
mov edi, dword [eax + 0x3c]
lea esi, [eax + 0x3c]
mov eax, dword [esi + 4]
shr edi, 8
cmp edi, eax
pop ebp
pop ebx
jb 0x41212a
push edi
mov ecx, esi
call fcn.0040f660
mov eax, dword [esi]
mov ecx, dword [esi + 0xc]
and eax, 0xff
lea edx, [eax + eax*2]
mov eax, dword [ecx + edi*4]
lea ecx, [eax + edx*4]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [ecx], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
mov eax, dword [esi]
inc eax
pop edi
mov dword [esi], eax
pop esi
add esp, 0x24
ret 4
Function at 0x412160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
lea eax, [ebp + 3]
and eax, 0xfffffffc
push esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
push edi
lea ecx, [eax + ebp]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], ebx
call fcn.0040f4f0
mov edi, dword [esp + 0x3c]
mov ecx, edi
call fcn.0040ffd0
mov eax, SysReAllocString
mov dword [edi + 0x68], eax
mov dword [edi + 0x6c], eax
mov eax, SysReAllocString
xor ecx, ecx
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
mov al, byte [esp + 0x30]
test al, al
mov eax, dword [esp + 0x24]
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x78], ecx
je 0x4121ed
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
lea ebx, [eax - 1]
imul ebx, ecx
add ebx, edx
mov edx, dword [esp + 0x2c]
add edx, eax
neg ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10], ecx
test eax, eax
jle 0x4122eb
mov edx, dword [esp + 0x2c]
dec edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x14]
xor edx, edx
test ebp, ebp
mov dword [esi + 8], 0x7ffffff0
mov dword [esi + 0x18], eax
mov dword [esp + 0x30], ebx
jle 0x4122aa
lea ecx, [ecx]
mov ecx, dword [esp + 0x30]
mov al, byte [ecx]
test al, al
je 0x412298
movzx ecx, al
cmp ecx, 0x40
jne 0x412239
mov ecx, 0xff
jmp 0x41223c
shl ecx, 2
mov ebp, dword [esi]
mov ebx, dword [esp + 0x28]
mov eax, edx
sub eax, ebp
mov ebp, dword [esp + 0x34]
mov cl, byte [ebp + ecx*4 + 0x5c]
add eax, ebx
mov ebx, dword [esi + 0x10]
mov byte [eax + ebx], cl
mov ecx, dword [esi + 8]
inc ecx
cmp eax, ecx
jne 0x412267
mov ecx, dword [esi + 0x18]
inc word [ecx + 2]
jmp 0x41228d
mov ecx, dword [esi + 0x18]
mov bx, word [esi]
add ecx, 8
mov dword [esi + 0x18], ecx
add bx, ax
mov word [ecx], bx
mov ecx, dword [esi + 0x18]
mov word [ecx + 2], 1
mov ecx, dword [esi + 0x10]
mov ebx, dword [esi + 0x18]
add ecx, eax
mov dword [ebx + 4], ecx
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
inc eax
inc edx
cmp edx, ebp
mov dword [esp + 0x30], eax
jl 0x412220
mov edx, dword [esp + 0x10]
mov ecx, dword [esi + 0x14]
add ebx, edx
mov edx, dword [esi + 0x18]
sub edx, ecx
test edx, 0xfffffff8
mov dword [esp + 0x14], ebx
je 0x4122d3
mov eax, dword [esp + 0x1c]
push esi
mov ecx, edi
mov dword [esi + 0xc], eax
call fcn.00412030
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
dec ecx
dec eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], eax
jne 0x412202
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x517870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x18], 0x3c8
mov dword [ebp - 0x5c], 0x25c
mov dword [ebp - 0x74], 0x3b2
mov dword [ebp - 0x78], 0x180
mov dword [ebp - 0x28], 0x2d9
mov dword [ebp - 0x10], 0x2a5
mov dword [ebp - 8], 0x136
mov dword [ebp - 0x7c], 0x33
mov dword [ebp - 0x68], 0x17e
mov dword [ebp - 0x80], 0x234
mov dword [ebp - 0x1c], 0xa1
mov dword [ebp - 0x84], pe_nt_image_headers32
mov dword [ebp - 0x30], 0x2e0
mov dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x24], 0x1e5
mov dword [ebp - 0x58], 0x22b
mov dword [ebp - 0x20], 0x379
mov dword [ebp - 0xc], 0x250
mov dword [ebp - 0x34], 0x382
mov dword [ebp - 0x14], 0x58
mov dword [ebp - 4], 0x26a
mov dword [ebp - 0x6c], 0x190
mov dword [ebp - 0x60], 0x1ee
mov dword [ebp - 0x64], 0x32d
mov dword [ebp - 0x44], 0x323
mov eax, dword [ebp - 0x24]
sub eax, 0x1a3
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0xe8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, 0x131
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, 0xbc
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, 0x99
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x319
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.0040f980
add esp, 0x18
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x58]
jge 0x5179ab
mov dword [ebp - 0x38], 1
jmp 0x5179b2
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x5c]
jge 0x5179c3
mov dword [ebp - 0x3c], 1
jmp 0x5179ca
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x5179db
mov dword [ebp - 0x40], 1
jmp 0x5179e2
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x38]
and ecx, dword [ebp - 0x3c]
and ecx, dword [ebp - 0x40]
je 0x5179f6
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10007e90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010cceb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1019d120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0xc]
mov dword [edi], vtable.EventInterface.0
lea ecx, [esi + 8]
mov dword [ebp - 0x14], esi
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
mov dword [ebp - 4], 0
push 0x10141ca3
mov byte [esi], 0xff
mov dword [esi + 4], 0xffffffff
call fcn.1000a4c0
mov word [esi + 0x20], 0
mov byte [esi + 0x22], 0
mov ecx, dword [ebp + 8]
lea edx, [esi + 8]
mov dword [ebp - 4], 1
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov al, byte [ecx]
mov byte [esi], al
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ecx + 8]
cmp edx, eax
je 0x10007f4d
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x10007f40
mov eax, dword [eax]
push edx
push eax
lea ecx, [esi + 8]
call fcn.1000a4c0
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 0x20]
mov byte [esi + 0x20], al
movzx eax, byte [ecx + 0x21]
mov byte [esi + 0x21], al
movzx eax, byte [ecx + 0x22]
mov byte [esi + 0x22], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
call fcn.100c7e32
mov dword [edi + 0x30], eax
mov eax, edi
mov dword [edi + 0x34], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010cf30
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1019d120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100df118
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100c827e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021040
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.10021230
mov eax, dword [ebp - 8]
test eax, eax
je 0x10021096
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.100c7ffa
int3

Function at 0x100213a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x100213cb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100213b4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x10032a20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10032b8d
lea eax, [ecx - 1]
mov esi, dword [0x101a2484]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101a248c
lea eax, [edi + edi]
push eax
call fcn.10032440
mov eax, dword [0x101a2484]
lea ebx, [edi - 1]
mov dword [0x101a2498], ebx
mov dword [0x101a249c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10032b84
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101a248c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10032ae2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10032b4f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10032b1c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10032b14
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10032b4f
cmp ebx, edx
je 0x10032b2c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10032b60
cmp ebx, edx
jne 0x10032b20
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10032b84
mov ebx, dword [0x101a2498]
jmp 0x10032a90
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10032b4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.100c7fda
int3
Function at 0x1003e6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0xc]
not eax
mov dword [ebp - 4], ebx
cmp edi, 8
jb 0x1003e79f
mov ecx, edi
shr ecx, 3
mov dword [ebp + 8], ecx
mov ebx, dword [esi + 4]
sub edi, 8
mov ecx, dword [esi]
add esi, 8
xor ecx, eax
mov eax, ebx
shr eax, 0x10
movzx edx, al
mov eax, ebx
mov dword [ebp + 0xc], ecx
shr eax, 8
movzx ecx, al
mov eax, dword [edx*4 + 0x10154dd8]
mov edx, dword [ebp + 0xc]
xor eax, dword [ecx*4 + 0x101551d8]
mov ecx, edx
shr ecx, 0x10
movzx ecx, cl
xor eax, dword [ecx*4 + 0x10155dd8]
mov ecx, edx
shr ecx, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101561d8]
mov ecx, ebx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x101549d8]
mov ecx, edx
shr ecx, 0x18
xor eax, dword [ecx*4 + 0x101559d8]
movzx ecx, bl
xor eax, dword [ecx*4 + 0x101555d8]
movzx ecx, dl
xor eax, dword [ecx*4 + 0x101565d8]
sub dword [ebp + 8], 1
jne 0x1003e717
mov ebx, dword [ebp - 4]
test edi, edi
je 0x1003e7bd
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101549d8]
sub edi, 1
jne 0x1003e7a3
pop edi
not eax
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1003e8c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10194610
push 0x100e0a80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1019d120]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x1003e963
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1003e963
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x1003e963
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x1003e963
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1003e96c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.100df0d4
mov esp, ebp
pop ebp
ret
Function at 0x1003ec80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1019d120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x1003ed49
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x1003ecc6
sub edi, 0x8000000
jmp 0x1003ed41
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1003ed49
cmp dword [ebp - 0x10], 0x10000
jne 0x1003ed2c
cmp dword [ebp - 0x14], 0x10000
jb 0x1003ed2c
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1003ee04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x1003ed49
sub edi, 0x10000
jmp 0x1003ed41
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x1003ecb1
movzx eax, si
test eax, eax
je 0x1003ed58
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x1003ee02
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x1003ed85
add esi, 0x8000000
jmp 0x1003edfa
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0x1003ee02
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x1003ede5
cmp ecx, 0x10000
jb 0x1003ede5
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1003ee04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x1003ee02
add esi, 0x10000
jmp 0x1003edfa
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x1003edfa
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x1003ed70
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100df0d4
mov esp, ebp
pop ebp
ret
Function at 0x1003ee20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1019d120]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101a24f0], 0
jne 0x1003eea9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x101a24f0
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003eea9
push esi
mov esi, dword [0x101a24fc]
mov dword [0x101a2504], eax
mov dword [0x101a2500], eax
mov dword [0x101a24f8], eax
push edi
test esi, esi
je 0x1003ee8a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x1003eea1
mov esi, dword [esi + 4]
test esi, esi
jne 0x1003ee71
xor eax, eax
pop edi
mov dword [0x101a24ac], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100df0d4
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003ee8c
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.100df0d4
mov esp, ebp
pop ebp
ret
Function at 0x1003f300
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x101a24ac]
push esi
mov esi, ecx
test eax, eax
jne 0x1003f36e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
jne 0x1003f31a
xor eax, eax
pop esi
ret
push edi
push 8
call fcn.100df118
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1003f35b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.100df105
add esp, 8
mov dword [0x101a24ac], esi
mov eax, esi
mov dword [0x101a24f8], 0
pop edi
pop esi
ret
mov eax, dword [0x101a2500]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [0x101a2500], edi
pop edi
pop esi
ret