joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x4b537d
cmp eax, edi
jge 0x4b536d
push esi
call fcn.004afb00
add esp, 4
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
sub dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor ecx, ecx
mov edx, eax
test eax, eax
jle 0x4b53ad
mov eax, dword [esi + 0xc]
push ebx
mov bl, al
nop dword [eax + eax]
mov byte [esp + ecx + 0x10], bl
sub edx, 8
shr eax, 8
inc ecx
mov dword [esi + 0xc], eax
mov bl, al
test edx, edx
jg 0x4b5390
mov dword [esi + 8], edx
pop ebx
cmp ecx, 4
jge 0x4b53c9
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4b53ba
xor dl, dl
jmp 0x4b53bf
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 4
jl 0x4b53b0
mov eax, dword [esp + 0xc]
movzx ecx, byte [esp + 0xf]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [esp + 0xe]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4b5401
mov dword [0x655470], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4b5419
pop edi
mov dword [0x655470], 0x5fa9cc
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4b5433
push edi
push ecx
push esi
call fcn.004b94d0
add esp, 0xc
test eax, eax
je 0x4b53fc
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005b46d0
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
ret
Function at 0x4bb430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
push ebx
mov ebx, dword [esp + 8]
push edi
lea edi, [ecx + 4]
test edi, edi
jle 0x4bb46b
push esi
mov esi, dword [ebx]
sub esi, ecx
sub esi, 4
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x64d198]
sub edi, 1
jne 0x4bb450
pop esi
mov ecx, dword [ebx]
not eax
mov edx, eax
shr edx, 0x18
pop edi
mov byte [ecx], dl
mov edx, eax
mov ecx, dword [ebx]
shr edx, 0x10
mov byte [ecx + 1], dl
mov edx, eax
mov ecx, dword [ebx]
shr edx, 8
mov byte [ecx + 2], dl
mov ecx, dword [ebx]
mov byte [ecx + 3], al
add dword [ebx], 4
pop ebx
ret
Function at 0x4c06c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e5b89
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x64e2c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x655918]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x655458]
cmp eax, dword [ecx + 0x10]
jg 0x4c0859
mov edx, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov ecx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x34], eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
lea esi, [ecx + 1]
mov dword [ebp - 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4c0733
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0042e940
cmp dword [ebp - 0x14], 0xf
lea esi, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x28]
xor ecx, ecx
test edi, edi
je 0x4c0771
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4c0760
push edx
lea eax, [ebp - 0x28]
mov ecx, 0x655438
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0043b530
mov ecx, dword [0x65543c]
mov esi, ecx
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x4c07d0
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c07c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c08a7
push ecx
push edx
call fcn.005b26d8
mov ecx, dword [0x65543c]
add esp, 8
cmp esi, ecx
je 0x4c07ed
mov eax, dword [esi + 0x24]
test eax, eax
je 0x4c07df
lock inc dword [eax + 4]
mov eax, dword [esi + 0x20]
mov esi, dword [esi + 0x24]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], esi
jmp 0x4c0804
push dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov ecx, 0x655438
push dword [ebp - 0x2c]
push eax
call fcn.0043c530
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], 1
call fcn.004c0510
test esi, esi
je 0x4c083c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4c083c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4c083c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret 8
push 0x655458
call fcn.005b2bcf
add esp, 4
cmp dword [0x655458], 0xffffffff
jne 0x4c070d
mov ecx, 0x655418
mov dword [ebp - 4], 0
call fcn.0043ba10
push 0x5ec490
call fcn.005b2b3e
push 0x655458
mov dword [ebp - 4], 0xffffffff
call fcn.005b2b7e
add esp, 8
jmp 0x4c070d
call fcn.005c1009
int3
Function at 0x4f641e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4f6445
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4f6448
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004f63fa
pop esi
leave
ret 8
Function at 0x4f8820
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x4f8976
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.005b26d8
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x4f88d9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4f8897
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x4f896c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x4f88ed
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x4f88f0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x4f896c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.005b26d8
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x4f897d
cmp esi, eax
jne 0x4f8947
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x4f8900
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4fa380
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x64e2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x4fa3b4
pop edi
mov eax, 0x80070057
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push esi
push 0
push 3
push 1
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFile2]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
cmove esi, eax
test esi, esi
jne 0x4fa3fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4fa4db
pop esi
movzx eax, ax
pop edi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push 0x18
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x4fa479
cmp dword [ebp - 0x10], 0
jg 0x4fa4cf
mov eax, dword [ebp - 0x14]
cmp eax, 0x22
jb 0x4fa4cf
push 0x626080
push eax
call fcn.005b3706
mov ecx, dword [edi]
add esp, 8
mov dword [edi], eax
test ecx, ecx
je 0x4fa444
push ecx
call fcn.005b301d
add esp, 4
mov eax, dword [edi]
test eax, eax
jne 0x4fa467
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push 0
push ebx
push dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4fa4a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4fa48e
movzx edi, di
or edi, 0x80070000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
cmp eax, dword [ebp - 0x14]
push esi
sbb edi, edi
and edi, 0x80004005
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
Function at 0x4fdf70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x64e2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
test esi, esi
jne 0x4fdfa8
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push eax
call fcn.004fbad0
add esp, 4
push 0
push 0x8000000
push 3
push 0
push 1
push Ordinal_1
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
cmove esi, eax
test esi, esi
jne 0x4fdffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4fe128
movzx eax, ax
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push edi
push 0x18
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
jne 0x4fe03f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4fe026
movzx edi, di
or edi, 0x80070000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x14], 0
jle 0x4fe061
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 0x800700df
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x18]
cmp ebx, 0xb
jb 0x4fe0e8
push 0x626080
push ebx
call fcn.005b3706
mov edi, eax
add esp, 8
test edi, edi
jne 0x4fe09b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 0x8007000e
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp - 0x18]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4fe0d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x4fe0cc
movzx ebx, bx
or ebx, 0x80070000
push edi
call fcn.005b301d
add esp, 4
jmp 0x4fe11d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
je 0x4fe105
push edi
call fcn.005b301d
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push ebx
push edi
call fcn.004fe140
push edi
mov ebx, eax
call fcn.005b301d
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005b26e6
mov esp, ebp
pop ebp
ret
Function at 0x50fed0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e69d4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x64e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x30
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x20]
mov byte [ebp - 4], 3
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 4
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b2e07
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0x30
call fcn.005b2e07
add esp, 0x1c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5280e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e812c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x64e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], 0xffffffff
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
lea ecx, [esi + 0xa8]
mov dword [ebp - 4], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x8c], 0x3f800000
mov dword [esi + 0x90], 0xffffffff
mov dword [esi + 0x94], 0x3f800000
mov dword [esi + 0x98], 0x3f800000
mov word [esi + 0x9c], 0
mov byte [esi + 0x9e], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
call fcn.00527ee0
mov dword [esi + 0x168], 0
mov dword [esi + 0x198], 0
push 0x528e10
push 0x528320
push 6
lea eax, [esi + 0x1f0]
mov byte [ebp - 4], 2
push 0x34
push eax
mov dword [ebp - 0x10], eax
call fcn.005b2e94
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov dword [esi + 0x1c8], 0
mov dword [esi + 0x1dc], 0
cmp eax, dword [ecx]
jne 0x52825d
xorps xmm0, xmm0
movups xmmword [esi + 0x4c], xmm0
movups xmmword [esi + 0x5c], xmm0
jmp 0x528295
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
cmp eax, dword [ecx]
mov eax, esi
jne 0x5282cc
xorps xmm0, xmm0
movups xmmword [esi + 0x6c], xmm0
movups xmmword [esi + 0x7c], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x52dcf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, 0x811c9dc5
mov edi, dword [ebx + 4]
mov edx, 0
mov ecx, dword [ebx]
add edi, edi
je 0x52dd28
movzx eax, byte [edx + ecx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, edi
jb 0x52dd14
mov eax, dword [ebp - 4]
push esi
push ebx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.0052d900
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x52dd48
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x52f100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e8500
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x64e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebx + 4]
test edi, edi
je 0x52f23f
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x52f23f
mov esi, dword [eax + 0x18]
lea edx, [eax + 8]
test esi, esi
je 0x52f22b
cmp dword [eax + 0x1c], 8
lea ecx, [ebx + 8]
jb 0x52f15e
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], esi
push eax
call fcn.0052dcf0
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
je 0x52f23f
dec dword [esi + 0x14]
cmp dword [esi + 0x14], 0
jg 0x52f23f
mov edi, dword [esi + 0xc]
mov edx, 0x811c9dc5
mov ecx, 0
add edi, edi
je 0x52f1b4
mov ebx, dword [esi + 8]
nop
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x52f1a0
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebx + 0x20]
lea edi, [ebx + 0xc]
mov eax, dword [ebx + 0x14]
and ecx, edx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x52f1de
cmp eax, esi
jne 0x52f1d6
mov eax, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x52f1e6
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x52f1e6
cmp eax, esi
jne 0x52f1e6
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 4]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x10]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x52f210
mov eax, dword [ecx]
call dword [eax + 8]
mov dword [esi + 0x10], 0
push 1
push esi
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0052f750
mov edi, dword [ebx + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi]
push ecx
mov ecx, esp
push dword [ebp + 8]
mov esi, dword [eax + 0x18]
call fcn.0050fa70
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5373b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e86ed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x64e2c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.005b2e07
add esp, 4
test eax, eax
je 0x5373ea
mov dword [eax], esi
jmp 0x5373ec
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x537130
push 0
push 0
call fcn.005c5ee8
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x537435
cmp dword [esi + 4], 0
jne 0x537443
mov eax, dword [ebp - 0x14]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call fcn.005da3ca
call fcn.005c5d50
int3

Function at 0x5386e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005b8bea
add esp, 0x10
pop ebp
ret 8

Function at 0x538720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.005b98c4
add esp, 0x10
pop ebp
ret 8

Function at 0x538740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xorps xmm2, xmm2
movups xmm0, xmmword [eax]
ucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x53875e
mov dword [ebp + 8], 0
jmp 0x538763
movss dword [ebp + 8], xmm0
mov edx, dword [ebp + 8]
movaps xmm1, xmm0
movzx eax, dl
xor eax, 0x811c9dc5
shufps xmm1, xmm0, 0x55
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
push esi
push edi
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul edi, ecx, 0x1000193
xor edi, edx
ucomiss xmm1, xmm2
lahf
test ah, 0x44
jp 0x5387b4
mov dword [ebp + 8], 0
jmp 0x5387b9
movss dword [ebp + 8], xmm1
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
shufps xmm0, xmm0, 0xaa
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul esi, ecx, 0x1000193
xor esi, edx
ucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x538805
mov dword [ebp + 8], 0
jmp 0x53880a
movss dword [ebp + 8], xmm0
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
add eax, edi
add eax, esi
pop edi
imul eax, eax, 0x1000193
pop esi
pop ebp
ret 4