joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5d50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4c5ebd
lea eax, [ecx - 1]
mov esi, dword [0x5716a0]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x5716a8
lea eax, [edi + edi]
push eax
call fcn.0042de30
mov eax, dword [0x5716a0]
lea ebx, [edi - 1]
mov dword [0x5716b4], ebx
mov dword [0x5716b8], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4c5eb4
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x5716a8]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x4c5e12
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4c5e7f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x4c5e4c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4c5e44
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x4c5e7f
cmp ebx, edx
je 0x4c5e5c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x4c5e90
cmp ebx, edx
jne 0x4c5e50
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x4c5eb4
mov ebx, dword [0x5716b4]
jmp 0x4c5dc0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4c5e7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.004cfb26
int3
Function at 0x4c5ed0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4c603d
lea eax, [ecx - 1]
mov esi, dword [0x5694d8]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x5694e0
lea eax, [edi + edi]
push eax
call fcn.0042de30
mov eax, dword [0x5694d8]
lea ebx, [edi - 1]
mov dword [0x5694ec], ebx
mov dword [0x5694f0], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4c6034
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x5694e0]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x4c5f92
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4c5fff
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x4c5fcc
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4c5fc4
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x4c5fff
cmp ebx, edx
je 0x4c5fdc
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x4c6010
cmp ebx, edx
jne 0x4c5fd0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x4c6034
mov ebx, dword [0x5694ec]
jmp 0x4c5f40
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4c5fff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.004cfb26
int3
Function at 0x4c6240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4c637a
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x14], ecx
lea eax, [edi + edi]
push eax
call fcn.0042de30
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4c634d
mov bl, byte [eax + 8]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0xc], edx
cmp edi, esi
jne 0x4c62d9
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4c6343
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x4c6310
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4c6308
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x4c6343
cmp edi, edx
je 0x4c6320
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x4c6356
cmp edi, edx
jne 0x4c6314
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x4c62a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4c6343
push str.invalid_hash_bucket_count
call fcn.004cfb26
int3
Function at 0x4cb800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508f1d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x55b18c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
cmp dword [edx + 0x14], 0x10
mov dword [ebp - 0x10], edx
jb 0x4cb847
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4cb86b
mov ebx, dword [ebp - 0x10]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4cb856
mov ebx, dword [ebp - 0x1c]
push edi
push edx
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00430b60
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4cb89b
mov dword [ebx], eax
mov eax, ebx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x3ffffff
je 0x4cb9ec
lea eax, [esi + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x28], 0
call fcn.004d2193
mov ebx, eax
add esp, 4
mov dword [ebp - 0x28], ebx
push dword [ebp - 0x18]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x10], esi
call fcn.00414110
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.0047abc0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x1c]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ecx
addsd xmm0, qword [eax*8 + 0x548840]
cvtdq2pd xmm1, xmm1
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x548840]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4cb98c
divss xmm0, xmm3
call fcn.004277c0
call fcn.004fc920
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x4cb970
cmp eax, 0x200
jae 0x4cb96e
shl eax, 3
cmp eax, ecx
jae 0x4cb970
mov eax, ecx
push eax
mov ecx, esi
call fcn.00472780
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00430b60
mov edx, dword [eax]
jmp 0x4cb98f
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x2c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x4cb9b9
mov dword [ecx + eax*8], ebx
jmp 0x4cb9cb
cmp esi, edx
jne 0x4cb9c2
mov dword [ecx + eax*8], ebx
jmp 0x4cb9cf
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4cb9cf
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp - 0x1c]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004cfb26
int3
Function at 0x4cca30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4ccaa4
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.00492200
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4cca60
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4ccace
test cl, 1
jne 0x4ccace
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccb07
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00492200
test al, al
je 0x4ccb07
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4ccad3
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ccb20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4ccb94
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.004922a0
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4ccb50
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4ccbbe
test cl, 1
jne 0x4ccbbe
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccbf7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004922a0
test al, al
je 0x4ccbf7
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4ccbc3
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ccc10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4ccc84
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.00492330
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4ccc40
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4cccae
test cl, 1
jne 0x4cccae
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccce7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00492330
test al, al
je 0x4ccce7
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4cccb3
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ccd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4ccd74
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.004925c0
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4ccd30
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4ccd9e
test cl, 1
jne 0x4ccd9e
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccdd7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004925c0
test al, al
je 0x4ccdd7
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4ccda3
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ccdf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4cce64
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.00492850
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4cce20
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4cce8e
test cl, 1
jne 0x4cce8e
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccec7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00492850
test al, al
je 0x4ccec7
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4cce93
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ccee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x4ccf54
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0xd8
add ecx, ebx
lea eax, [ecx - 0xd8]
push eax
push ecx
call fcn.00492ba0
imul ecx, dword [ebp - 8], 0xd8
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0xd8
add ecx, ebx
add eax, ebx
push eax
call fcn.004459e0
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x4ccf10
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x4ccf7e
test cl, 1
jne 0x4ccf7e
imul eax, ecx, 0xd8
imul ecx, esi, 0xd8
add eax, 0xffffff28
add eax, ebx
add ecx, ebx
push eax
call fcn.004459e0
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x4ccfb7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0xd8
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.00492ba0
test al, al
je 0x4ccfb7
push dword [ebp - 4]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x4ccf83
push dword [ebp - 0x10]
imul ecx, edi, 0xd8
add ecx, ebx
call fcn.004459e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ced64
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.004ced40
pop esi
leave
ret 8

Function at 0x4d2f22
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d2f61
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d2f61
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d2f61
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d2f61
cmp dword [ecx + 0x74], 0xe
jbe 0x4d2f61
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4d95e6
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x10], 0
jne 0x4d95f3
xor al, al
ret
cmp dword [eax + 0x14], 8
jb 0x4d95fb
mov eax, dword [eax]
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x4ec4ca
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52eabc
push 0x52eab4
push str.FlsAlloc
push 0x1f
call fcn.004ec2f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ec4fe
push dword [ebp + 8]
mov ecx, esi
call dword [0x50c4a0]
call esi
jmp 0x4ec504
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4ec548
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52eacc
push 0x52eac4
push str.FlsGetValue
push 0x21
call fcn.004ec2f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ec57f
push dword [ebp + 8]
mov ecx, esi
call dword [0x50c4a0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4ec587
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x52ead4
push 0x52eacc
push str.FlsSetValue
push 0x22
call fcn.004ec2f5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ec5c1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x50c4a0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4ef1de
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004d3180
mov eax, dword [0x55b18c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004eb052
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4ef220
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4ef37c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004fc340
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x564d78]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004f0065
mov ecx, dword [esi*4 + 0x564d78]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4ef375
cmp eax, dword [ecx + edi + 0x24]
jne 0x4ef375
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ef375
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004f0065
add esp, 0x14
test edx, edx
jl 0x4ef375
jg 0x4ef2eb
test eax, eax
jb 0x4ef375
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4ef375
jl 0x4ef305
cmp dword [ebp - 0x1008], eax
ja 0x4ef375
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4ef323
test ebx, ebx
je 0x4ef35c
cmp ecx, edi
jae 0x4ef35c
mov al, byte [ecx]
cmp al, 0xd
jne 0x4ef33d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4ef349
cmp byte [ecx + 1], 0xa
jne 0x4ef349
inc ecx
jmp 0x4ef349
movzx eax, al
movsx eax, byte [eax + 0x55b428]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4ef323
cmp edx, ebx
jne 0x4ef323
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4ef37a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004d20a0
leave
ret