joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014ccc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1014ccec
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1033e798]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1033e7a0
lea eax, [edi + edi]
push eax
call fcn.10093aa0
mov eax, dword [0x1033e798]
lea ebx, [edi - 1]
mov dword [0x1033e7ac], ebx
mov dword [0x1033e7b0], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1014ce26
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1033e7a0]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1014cd84
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1014cdf1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1014cdbe
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1014cdb6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1014cdf1
cmp ebx, edx
je 0x1014cdce
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1014ce02
cmp ebx, edx
jne 0x1014cdc2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1014ce26
mov ebx, dword [0x1033e7ac]
jmp 0x1014cd32
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1014cdf1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10151640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10167f55
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x1015166e
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10151691
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10151680
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.10151a10
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x101516bf
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10323968], 0x71c71c7
jne 0x101516d6
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10323964
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.101600a6
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.100936c0
mov ecx, dword [ebx + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x10323968]
mov ebx, dword [0x1032397c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x1027e510]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1027e510]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x10323960]
comiss xmm2, xmm1
jbe 0x101517b0
divss xmm0, xmm1
call fcn.1005ae30
call fcn.10162010
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10151792
cmp ebx, 0x200
jae 0x10151790
shl ebx, 3
cmp ebx, ecx
jae 0x10151792
mov ebx, ecx
push ebx
call fcn.10151820
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10151a10
mov ecx, dword [0x10323968]
mov edx, dword [eax]
jmp 0x101517b3
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x10323968], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x10323978]
mov ecx, dword [0x1032396c]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x10323964]
jne 0x101517e4
mov dword [ecx + eax*8], edi
jmp 0x101517f3
cmp esi, edx
jne 0x101517ed
mov dword [ecx + eax*8], edi
jmp 0x101517f7
cmp dword [ecx + eax*8 + 4], ebx
jne 0x101517f7
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10153e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016bc6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea ebx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
cmp ebx, eax
je 0x10153f2b
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [ebx + 8]
sub edi, esi
mov dword [ebp + 8], esi
cmp edi, edx
jbe 0x10153ee1
cmp edi, 0x7fffffff
ja 0x10153fe0
mov ecx, edx
mov eax, 0x7fffffff
shr ecx, 1
sub eax, ecx
cmp edx, eax
jbe 0x10153ebd
mov eax, 0x7fffffff
jmp 0x10153ec5
lea eax, [ecx + edx]
cmp eax, edi
cmovb eax, edi
push eax
mov ecx, ebx
call fcn.10154400
mov esi, dword [ebx]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + edi]
mov dword [ebx + 4], eax
jmp 0x10153f22
mov eax, dword [ebx + 4]
mov dword [ebp + 8], eax
cmp edi, eax
jbe 0x10153f16
push eax
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esi, eax
sub edi, eax
mov dword [ebp + 8], esi
mov esi, dword [ebx + 4]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + edi]
add esp, 0x18
mov dword [ebx + 4], eax
jmp 0x10153f25
push edi
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov dword [ebx + 4], edi
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
mov dword [edi + 0x1c], esi
mov eax, dword [ecx + 4]
mov edx, eax
mov ebx, dword [ecx]
sub edx, ebx
mov dword [ebp + 8], eax
cmp esi, edx
jae 0x10153f4b
lea eax, [esi + ebx]
mov dword [ecx + 4], eax
jmp 0x10153f76
jbe 0x10153f76
mov eax, dword [ecx + 8]
sub eax, ebx
cmp esi, eax
jbe 0x10153f5f
push ecx
push esi
call fcn.10154480
jmp 0x10153f76
mov ebx, dword [ebp + 8]
sub esi, edx
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [edi + 0x1c]
push dword [edi]
call esi
push dword [edi + 0x1c]
push dword [edi]
push dword [edi + 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [edi + 0x1c]
push dword [edi]
call esi
call fcn.10153dc0
mov dword [ebp + 8], edi
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x10153fbf
mov dword [ecx], edi
add dword [eax + 4], 4
jmp 0x10153fcb
lea edx, [ebp + 8]
push edx
push ecx
mov ecx, eax
call fcn.1013e260
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.100937c0
int3
Function at 0x1015b970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [ecx + 0x48]
push edi
mov al, byte [esi]
test al, al
jne 0x1015b98f
mov eax, 0x811c9dc5
jmp 0x1015b9a5
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dd940
mov dword [esp + 0x10], eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1015ba60
mov eax, dword [eax]
cmp dword [eax + 0xc], 0
jne 0x1015ba13
mov ecx, dword [0x1033e7f4]
push esi
mov eax, dword [ecx]
call dword [eax + 0x34]
mov cl, byte [esi]
mov dword [esp + 0x10], eax
test cl, cl
jne 0x1015b9df
mov eax, 0x811c9dc5
jmp 0x1015b9f5
movsx eax, cl
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dd940
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1015ba60
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov al, byte [esi]
test al, al
jne 0x1015ba20
mov eax, 0x811c9dc5
jmp 0x1015ba36
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dd940
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1015ba60
pop edi
pop esi
pop ebx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1015ba60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016c5c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.100960f0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1015bae8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x1015bafc
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.101600a6
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x1027e510]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1027e510]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1015bbc6
divss xmm0, xmm3
call fcn.1005ae30
call fcn.10162010
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1015bba8
cmp ebx, 0x200
jae 0x1015bba6
shl ebx, 3
cmp ebx, ecx
jae 0x1015bba8
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100b65b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100960f0
mov edx, dword [eax]
jmp 0x1015bbc9
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1015bbf4
mov dword [ecx + eax*8], esi
jmp 0x1015bc03
cmp edi, edx
jne 0x1015bbfd
mov dword [ecx + eax*8], esi
jmp 0x1015bc07
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1015bc07
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1015cc60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x1015f0e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov eax, dword [ebx]
nop
cmp edi, 7
ja case.default.0x1015f0f5
jmp dword [edi*4 + 0x1015f28c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x1015f138
sub ecx, 1
je 0x1015f125
sub ecx, 1
jne 0x1015f14b
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1015f1cd
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x10266398]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
sub edx, 1
jne 0x1015f154
and edi, 7
jmp 0x1015f0f0
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x10266398]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10266398]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1015fbf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1015fc00
xor esi, esi
mov eax, 0x811c9dc5
sub edx, ecx
je 0x1015fc52
movzx ecx, byte [edi + esi]
inc esi
xor ecx, eax
imul eax, ecx, 0x1000193
cmp esi, edx
jb 0x1015fc12
cmp eax, 0x7c4a5426
ja 0x1015fc6c
je 0x1015fcc3
cmp eax, 0x39c98ba1
ja 0x1015fc57
je 0x1015fcc3
cmp eax, 0x2eb1674
je 0x1015fcc3
cmp eax, 0x19acc50e
je 0x1015fcc3
cmp eax, 0x2a5bf553
je 0x1015fcc3
xor al, al
pop edi
pop esi
ret
cmp eax, 0x3a712436
je 0x1015fcc3
cmp eax, 0x43d6266e
je 0x1015fcc3
cmp eax, 0x4d7aa8c1
jmp 0x1015fc50
cmp eax, 0xcb7412ac
ja 0x1015fc9a
je 0x1015fcc3
cmp eax, 0x9d08c4c8
ja 0x1015fc8c
je 0x1015fcc3
cmp eax, 0x7f11af2d
je 0x1015fcc3
cmp eax, 0x84ea2fe5
jmp 0x1015fc50
cmp eax, 0xa7eab73f
je 0x1015fcc3
cmp eax, 0xc941ff64
jmp 0x1015fc50
cmp eax, 0xe80bc214
ja 0x1015fcb1
je 0x1015fcc3
cmp eax, 0xd614ea2e
je 0x1015fcc3
cmp eax, 0xe1525a25
jmp 0x1015fc50
cmp eax, 0xee7a29e8
je 0x1015fcc3
cmp eax, 0xf8573d98
sete al
pop edi
pop esi
ret
pop edi
mov al, 1
pop esi
ret

Function at 0x1015fcd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1015fce0
xor esi, esi
sub edx, ecx
mov ecx, 0x811c9dc5
je 0x1015fd25
movzx eax, byte [edi + esi]
inc esi
xor eax, ecx
imul ecx, eax, 0x1000193
cmp esi, edx
jb 0x1015fcf2
cmp ecx, 0x5978b32e
ja 0x1015fd2a
je 0x1015fd3e
cmp ecx, 0x1b20e275
je 0x1015fd3e
cmp ecx, 0x3cb8abb3
je 0x1015fd3e
cmp ecx, 0x4c849f3c
je 0x1015fd3e
xor al, al
pop edi
pop esi
ret
cmp ecx, 0x97113ea7
je 0x1015fd3e
cmp ecx, 0xa8d619ea
sete al
pop edi
pop esi
ret
pop edi
mov al, 1
pop esi
ret

Function at 0x1015fd50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1015fd60
xor esi, esi
sub edx, ecx
mov ecx, 0x811c9dc5
je 0x1015fddb
movzx eax, byte [edi + esi]
inc esi
xor eax, ecx
imul ecx, eax, 0x1000193
cmp esi, edx
jb 0x1015fd72
cmp ecx, 0x92bbd4c5
ja 0x1015fdbe
je 0x1015fdb8
cmp ecx, 0x40401f1c
je 0x1015fdb8
cmp ecx, 0x688917bf
je 0x1015fdb8
cmp ecx, 0x74386b5b
jne 0x1015fddb
mov eax, dword [0x1033e7f4]
push str.SpellbookFlying_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
add esp, 8
mov al, 1
pop edi
pop esi
pop ecx
ret
cmp ecx, 0xdd7b05fd
je 0x1015fdb8
cmp ecx, 0xe5a5eadf
je 0x1015fdb8
cmp ecx, 0xf51a72ab
sete al
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x10161ad2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10161af9
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10161afc
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10161aae
pop esi
leave
ret 8
Function at 0x401830
Capabilities:
Identify system language via api
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x214]
sub esp, 0x288
mov dword [ebp - 0x270], eax
mov dword [esp], str.msi.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov word [ebp - 0x214], 0
mov edi, eax
push edx
mov dword [esp + 8], 0x104
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
sub esp, 0xc
test eax, eax
jne 0x40188a
test byte [section..data], 2
jne 0x401a32
lea eax, [ebp - 0x268]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x268], 0x28
mov word [ebp - 0x264], 0
call sub.msi.dll_MsiGetFileVersionW
sub esp, 0x14
test eax, eax
je 0x4018dd
test byte [section..data], 2
jne 0x401a05
lea eax, [ebp - 0x26c]
mov edx, dword [sym.imp.user32.dll_LoadStringW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0xa
mov dword [esp], edi
mov dword [ebp - 0x27c], edx
call edx
mov dword [ebp - 0x268], eax
inc eax
sub esp, 0x10
mov ecx, dword [sym.imp.ucrtbase.dll_malloc]
lea ebx, [eax + eax]
mov dword [ebp - 0x274], ecx
mov dword [esp], ebx
mov dword [ebp - 0x278], eax
call ecx
add ebx, 0x50
mov dword [esp], ebx
mov ecx, dword [ebp - 0x274]
mov esi, eax
mov dword [ebp - 0x26c], eax
call ecx
mov ebx, eax
test eax, eax
je 0x4019e0
test esi, esi
je 0x4019e0
mov eax, dword [ebp - 0x278]
mov word [esi], 0
mov edx, dword [ebp - 0x27c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0xa
mov dword [esp], edi
call edx
lea eax, [ebp - 0x264]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x26c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x268]
add eax, 0x29
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00401300
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
mov dword [esp + 0x14], 0
and eax, 0xffff
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.msi.dll_MsiMessageBoxW
sub esp, 0x18
mov eax, dword [ebp - 0x26c]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov dword [esp], ebx
call esi
mov eax, dword [ebp - 0x270]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.MsiGetFileVersion_failed_with__ld_n
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x4018dd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], str.GetModuleFileName_failed:__ld_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ShowUsage
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x40188a
Function at 0x401b80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, edx
sub esp, 0x10
mov ebx, eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 6]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x401be1
mov ecx, eax
xor eax, eax
lea esi, [esi]
mov dx, word [esi + eax]
mov word [ecx + eax + 4], dx
add eax, 2
test dx, dx
jne 0x401bb0
mov eax, dword [ebx]
mov dword [ecx], 0
test eax, eax
je 0x401bd8
lea esi, [esi]
mov ebx, eax
mov eax, dword [eax]
test eax, eax
jne 0x401bd0
mov dword [ebx], ecx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
test byte [section..data], 2
jne 0x401bf7
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov dword [esp + 0xc], str.Out_of_memory__n
mov dword [esp + 8], str.StringListAppend
mov dword [esp + 4], 0x406000
mov dword [esp], 1
call fcn.004017e0
jmp 0x401bea