joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ffd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov edx, ecx
lea eax, [edi + 0x6aa90]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
cmp eax, 0x2000
movzx eax, byte [ecx + 0x20]
setae byte [ebp - 1]
xor ebx, ebx
lea esi, [ecx + eax*2]
cmp ecx, esi
je 0x510023
mov ecx, ebx
mov eax, ebx
shr eax, 2
shl ecx, 6
add ecx, eax
movzx eax, word [edx]
add eax, 0x9e3779b9
add edx, 2
add eax, ecx
xor ebx, eax
cmp edx, esi
jne 0x510004
mov eax, 0x80060019
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xd
imul eax, eax, 0x2aaa
sub ebx, eax
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], eax
add eax, ebx
xor edx, edx
mov esi, 0x2aaa
mov ecx, 1
div esi
mov ebx, edx
lea eax, [ebx + ebx*4]
lea edi, [edi + eax*8]
xor eax, eax
lea edx, [edi + 0x24]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edx
cmp byte [ebp - 1], al
je 0x510087
mov ecx, 2
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
jne 0x510095
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
lock cmpxchg dword [edx], ecx
mov esi, eax
test esi, esi
je 0x510152
cmp esi, 1
jne 0x51011e
mov edi, dword [ebp - 0x10]
xor esi, esi
cmp esi, 0xa
jb 0x5100af
xor esi, esi
call sub.KERNEL32.dll_SwitchToThread
mov ebx, dword [edi]
nop
inc esi
cmp ebx, 1
je 0x5100a3
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov al, byte [edi + 0x20]
cmp al, byte [edx + 0x20]
jne 0x510135
movzx ecx, al
add ecx, ecx
sub ecx, 4
jb 0x5100e1
mov eax, dword [edi]
cmp eax, dword [edx]
jne 0x5100e6
add edi, 4
add edx, 4
sub ecx, 4
jae 0x5100d0
cmp ecx, 0xfffffffc
je 0x510113
mov al, byte [edi]
cmp al, byte [edx]
jne 0x510135
cmp ecx, 0xfffffffd
je 0x510113
mov al, byte [edi + 1]
cmp al, byte [edx + 1]
jne 0x510135
cmp ecx, 0xfffffffe
je 0x510113
mov al, byte [edi + 2]
cmp al, byte [edx + 2]
jne 0x510135
cmp ecx, 0xffffffff
je 0x510113
mov al, byte [edi + 3]
cmp al, byte [edx + 3]
jne 0x510135
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 2
je 0x51007c
push dword [ebp + 8]
mov ecx, edi
call fcn.0050fe00
test al, al
jne 0x510183
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x2aaa
jae 0x51007c
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0xc]
jmp 0x510045
mov eax, dword [ebp - 0x1c]
mov esi, 1
lock xadd dword [eax], esi
mov ecx, dword [ebp + 8]
lea eax, [ebx + ebx*4]
mov edi, dword [ebp - 0xc]
movups xmm0, xmmword [ecx]
movups xmmword [edi + eax*8], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [edi + eax*8 + 0x10], xmm0
mov cx, word [ecx + 0x20]
mov word [edi + eax*8 + 0x20], cx
nop
mov dword [edx], esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x515230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x515287
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x515250
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 4]
mov eax, dword [ebp + 0x10]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x5152d7
mov ecx, dword [ecx]
mov dword [ebp + 0x10], ecx
nop dword [eax + eax]
movzx edi, byte [ecx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x5152da
inc eax
cmp eax, ebx
je 0x5152d7
mov ecx, dword [ebp + 0x10]
jmp 0x5152a0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5152f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edx, ecx
xor edi, edi
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x515349
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x515312
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [edx + 4], eax
cmovb eax, dword [edx + 4]
dec eax
cmp eax, 0xffffffff
je 0x515393
mov ebx, dword [edx]
nop dword [eax + eax]
movzx edi, byte [ebx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x515396
dec eax
cmp eax, 0xffffffff
jne 0x515360
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x515740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp dword [eax + 0x14], 0x10
push ebx
push esi
push edi
mov edi, dword [eax + 0x10]
mov ebx, ecx
mov esi, eax
jb 0x51575b
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x515777
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x515766
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edx
mov edx, dword [ebx + 4]
mov dword [ebp - 4], edx
mov edi, dword [eax + ecx*8 + 4]
cmp edi, edx
je 0x515833
mov eax, dword [eax + ecx*8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop word [eax + eax]
cmp dword [edi + 0x1c], 0x10
lea eax, [edi + 8]
mov ecx, dword [eax + 0x10]
jb 0x5157ae
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x5157b8
mov edx, dword [ebx]
mov esi, dword [ebx + 0x10]
cmp esi, ecx
jne 0x515814
sub esi, 4
jb 0x5157d5
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x5157da
add edx, 4
add eax, 4
sub esi, 4
jae 0x5157c4
cmp esi, 0xfffffffc
je 0x51580e
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x515807
cmp esi, 0xfffffffd
je 0x51580e
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x515807
cmp esi, 0xfffffffe
je 0x51580e
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x515807
cmp esi, 0xffffffff
je 0x51580e
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x51580e
sbb eax, eax
or eax, 1
jmp 0x515810
xor eax, eax
test eax, eax
je 0x51581e
cmp edi, dword [ebp - 8]
je 0x515830
mov edi, dword [edi + 4]
jmp 0x5157a0
test edi, edi
je 0x515830
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x5169b0
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x800
push 0
push 0x78e548
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x516a4b
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x516a4b
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x516a41
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x516a96
cmp ecx, 0x8664
je 0x516a89
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x40]
movaps xmmword [ebp - 0x40], xmm0
push eax
movaps xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
je 0x516a96
cmp ecx, 9
je 0x516a89
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 2
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x516b30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x800
push 0
push 0x78e548
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x516bac
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x516bac
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x516ba8
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x516beb
cmp ecx, 0x8664
je 0x516be4
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
jmp 0x516bf0
xor eax, eax
jmp 0x516bf0
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
push eax
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
je 0x516beb
cmp ecx, 9
je 0x516be4
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
jmp 0x516bf0
mov eax, 2
jmp 0x516bf0
mov eax, 1
mov ecx, dword [ebp + 8]
pop esi
cmp eax, ecx
je 0x516c4a
cmp ecx, 2
jne 0x516c44
cmp eax, 3
jne 0x516c44
push 0x800
push 0
push 0x78e548
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x516c44
push str.GetMachineTypeAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x516c44
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 0x8664
call eax
test eax, eax
jne 0x516c44
test byte [ebp + 8], 3
jne 0x516c4a
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x51e870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x742e73
push eax
mov dword fs:[0], esp
sub esp, 0x88
cmp byte [0xa902b2], 0
push esi
push edi
je 0x51e996
cmp byte [0x8f0334], 0
je 0x51e996
lea eax, [ebp - 0x10]
push eax
call fcn.0051a030
push 4
mov dword [ebp - 4], 0
call fcn.00512870
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x51e8d9
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
jmp 0x51e8de
mov esi, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x14], edi
push 0
push 0x400
push edi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0051a120
push dword [ebp + 0x10]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
call fcn.00517150
push ecx
mov eax, esp
mov dword [ebp - 0x14], 0
mov dword [eax], edi
lea eax, [ebp - 0x5c]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.0051a1e0
lea ecx, [ebp - 0x5c]
call fcn.0051a330
test esi, esi
je 0x51e984
mov eax, dword [esi + 0xc]
mov dword [esi], 0x78e60c
test eax, eax
je 0x51e979
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x14]
call fcn.005f2880
mov edx, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], edx
push eax
mov dword [ebp - 0x20], edx
call edi
mov edi, dword [ebp + 8]
push 0x10
push esi
call fcn.00512900
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0051e3a0
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
mov esi, dword [ebp + 0x10]
push 0
push 0x400
push eax
call fcn.0051a120
push esi
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.00517150
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov byte [esi + 4], 1
mov dword [esi + 8], 0
push 0x38
mov byte [ebp - 4], 4
call fcn.00512870
add esp, 4
test eax, eax
je 0x51e9fe
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.0051a080
jmp 0x51ea00
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi], eax
cmp dword [eax + 0x30], 0
setne cl
mov byte [esi + 4], cl
lea ecx, [ebp - 0x94]
call fcn.0051a330
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x51ea30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x742e73
push eax
mov dword fs:[0], esp
sub esp, 0x88
cmp byte [0xa902b2], 0
push esi
push edi
je 0x51eb56
cmp byte [0x8f0334], 0
je 0x51eb56
lea eax, [ebp - 0x10]
push eax
call fcn.0051a030
push 4
mov dword [ebp - 4], 0
call fcn.00512870
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x51ea99
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
jmp 0x51ea9e
mov esi, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x14], edi
push 0
push 0x400
push edi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0051a120
push dword [ebp + 0x10]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
call fcn.00517300
push ecx
mov eax, esp
mov dword [ebp - 0x14], 0
mov dword [eax], edi
lea eax, [ebp - 0x5c]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.0051a1e0
lea ecx, [ebp - 0x5c]
call fcn.0051a330
test esi, esi
je 0x51eb44
mov eax, dword [esi + 0xc]
mov dword [esi], 0x78e60c
test eax, eax
je 0x51eb39
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x14]
call fcn.005f2880
mov edx, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], edx
push eax
mov dword [ebp - 0x20], edx
call edi
mov edi, dword [ebp + 8]
push 0x10
push esi
call fcn.00512900
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0051e3a0
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
mov esi, dword [ebp + 0x10]
push 0
push 0x400
push eax
call fcn.0051a120
push esi
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.00517300
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov byte [esi + 4], 1
mov dword [esi + 8], 0
push 0x38
mov byte [ebp - 4], 4
call fcn.00512870
add esp, 4
test eax, eax
je 0x51ebbe
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.0051a080
jmp 0x51ebc0
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi], eax
cmp dword [eax + 0x30], 0
setne cl
mov byte [esi + 4], cl
lea ecx, [ebp - 0x94]
call fcn.0051a330
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x520880
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0xa902b2], 0
je 0x5208d4
cmp byte [0x8f03cc], 0
je 0x5208d4
cmp byte [0xaf4714], 0
jne 0x5208c4
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [0xaf4718], eax
mov dword [0xaf471c], ecx
nop
mov byte [0xaf4714], 1
nop
mov eax, dword [0xaf4718]
mov edx, dword [0xaf471c]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0xaf4718]
mov eax, ecx
mov edx, dword [0xaf471c]
or eax, edx
jne 0x520911
cmp byte [0xaf4714], al
jne 0x520911
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [0xaf4718], ecx
mov dword [0xaf471c], edx
mov byte [0xaf4714], 1
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x520d90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0xa902b2], 0
push esi
push edi
je 0x520e51
cmp byte [0x8f03cc], 0
je 0x520e51
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp byte [0xaf4714], 0
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
jne 0x520ddf
mov dword [0xaf4718], edi
mov dword [0xaf471c], esi
nop
mov byte [0xaf4714], 1
nop
movsd xmm0, qword [0xaf4730]
ucomisd xmm0, qword [0x764250]
movsd qword [ebp - 8], xmm0
lahf
test ah, 0x44
jp 0x520e29
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.006ff2f0
movsd xmm1, qword [0x7649c8]
divsd xmm1, xmm0
movsd qword [ebp - 8], xmm1
movsd qword [0xaf4730], xmm1
sub edi, dword [0xaf4718]
mov ecx, edi
sbb esi, dword [0xaf471c]
mov edx, esi
call fcn.006ff2f0
mulsd xmm0, qword [ebp - 8]
pop edi
pop esi
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x155fab8]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xaf4728]
cmp eax, dword [ecx + 0x78c]
jg 0x520eaf
movsd xmm0, qword [0xaf4720]
movsd qword [ebp - 0x18], xmm0
call fcn.00520880
sub esi, eax
mov ecx, esi
sbb edi, edx
mov edx, edi
call fcn.006ff2f0
mulsd xmm0, qword [ebp - 0x18]
pop edi
pop esi
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
push 0xaf4728
call fcn.006fee91
add esp, 4
cmp dword [0xaf4728], 0xffffffff
jne 0x520e7d
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.006ff2f0
movsd xmm1, qword [0x7649c8]
divsd xmm1, xmm0
push 0xaf4728
movsd qword [0xaf4720], xmm1
call fcn.006fee47
add esp, 4
jmp 0x520e7d
Function at 0x525c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x741535
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x525cad
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x525cd2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x525cc0
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00487090
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x525d02
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x525e5b
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00512870
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00480e80
mov byte [edi + 0x20], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75a370]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x75a370]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x525dfa
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00711190
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006feff0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x525dde
cmp eax, 0x200
jae 0x525ddc
shl eax, 3
cmp eax, ecx
jae 0x525dde
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00492350
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00487090
mov edx, dword [eax]
jmp 0x525dfd
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x525e29
mov dword [ecx + eax*8], edi
jmp 0x525e3b
cmp esi, edx
jne 0x525e32
mov dword [ecx + eax*8], edi
jmp 0x525e3f
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x525e3f
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ea2aa
int3
Function at 0x526120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jb 0x526142
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x526161
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x526150
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x52618e
cmp esi, eax
jne 0x526185
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x526197
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x526197
cmp esi, eax
jne 0x52619a
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.00513980
push 0x24
push dword [ebp + 0xc]
call fcn.00512900
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x5261d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x5261ee
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x526214
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x526200
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00487090
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x526234
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8