joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10064930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x100f8040]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp dword [eax + 0x14], 0xf
mov esi, eax
push edi
mov edi, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
jbe 0x10064962
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10064981
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10064970
cmp dword [ebx + 4], 0
mov dword [esp + 0x5c], edx
mov dword [esp + 0xc], 0
jle 0x10064ad8
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, dword [ebx]
add ebx, ecx
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x100649c7
cmp dword [ecx + 4], 0
jle 0x100649c7
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp + 0x10]
push eax
push ecx
push dword [esp + 0x1c]
mov ecx, 0x10459388
call fcn.10064930
mov edi, dword [ebx]
mov esi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [edi + eax], 0
jne 0x100649d0
xor edx, edx
test eax, eax
je 0x100649f1
nop dword [eax]
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x100649e0
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], esi
push eax
lea eax, [esp + 0x20]
mov ecx, 0x104593a8
push eax
call fcn.100547a0
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x28]
add ecx, 0xc
push eax
call fcn.100544f0
mov eax, dword [eax]
cmp dword [eax + 0x14], 0
jne 0x10064ab7
lea eax, [esp + 0x5c]
mov ecx, 0x104593a8
push eax
lea eax, [esp + 0x30]
push eax
call fcn.100547a0
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x38]
add ecx, 0xc
push eax
call fcn.100544f0
mov ecx, 0x104593a8
mov eax, dword [eax]
mov byte [eax + 0xc], 0
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.100547a0
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x48]
add ecx, 0xc
push eax
call fcn.100544f0
mov ecx, 0x104593a8
mov eax, dword [eax]
mov dword [eax + 0x10], ebx
lea eax, [esp + 0x5c]
mov esi, dword [ebx + 0x2c]
add esi, dword [ebp + 0x10]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.100547a0
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x58]
add ecx, 0xc
push eax
call fcn.100544f0
mov eax, dword [eax]
mov dword [eax + 0x14], esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x18]
inc eax
mov ecx, dword [esp + 0x10]
add ecx, 0x3c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp eax, dword [ebx + 4]
jl 0x100649a0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d1e89
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10064d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100f8040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10064ea5
mov eax, dword [eax + 2]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10064ea5
push ebx
lea ebx, [eax - 4]
test ebx, ebx
je 0x10064ea4
mov eax, dword [ebx + 4]
test eax, eax
je 0x10064ea4
cmp eax, 0xc8
jg 0x10064ea4
cmp dword [ebx], 0
je 0x10064ea4
push esi
mov esi, dword [ebx + 8]
test esi, esi
je 0x10064ea3
push edi
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x10064d98
xor edx, edx
test ecx, ecx
je 0x10064db6
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10064da5
mov dword [ebp - 8], edi
cmp dword [ebx + 4], 0
mov dword [ebp - 0x18], 0
jle 0x10064ea2
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
mov ebx, dword [ebx]
add ebx, eax
mov esi, dword [ebx + 4]
test esi, esi
je 0x10064e89
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x10064de8
xor edx, edx
test eax, eax
je 0x10064e06
movsx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10064df5
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
mov ecx, 0x104593a8
call fcn.100542a0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10054280
cmp dword [eax + 8], 0
jne 0x10064e83
lea eax, [ebp - 8]
mov ecx, 0x104593a8
push eax
call fcn.100542a0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10054280
mov ecx, 0x104593a8
mov byte [eax], 1
lea eax, [ebp - 8]
mov esi, dword [ebx + 8]
push eax
call fcn.100542a0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10054280
mov ecx, 0x104593a8
mov dword [eax + 8], esi
lea eax, [ebp - 8]
push eax
call fcn.100542a0
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10054280
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
lea ebx, [ecx - 4]
inc esi
add eax, 0x3c
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp esi, dword [ebx + 4]
jl 0x10064dd2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d1e89
mov esp, ebp
pop ebp
ret 4
Function at 0x1009ebb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d569d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100f8040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
vpxor xmm0, xmm0, xmm0
xor edx, edx
mov dword [ebp - 0x2c], 0
mov edi, 0xf
mov dword [ebp - 0x18], edx
vmovdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
cmp esi, eax
je 0x1009ecbc
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1009ec33
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1009ec21
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10037cc0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1009ec4d
cmp edi, 0xf
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x1009ec5a
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10047470
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
test edx, edx
je 0x1009ec94
mov esi, dword [ebp - 0x34]
nop dword [eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x1009ec80
mov esi, dword [ebp - 0x30]
cmp edi, dword [ebp + 8]
jne 0x1009eca4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1009ecb7
dec eax
mov dword [ebp - 0x2c], eax
add esi, 0x1c
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
je 0x1009ecbc
mov edi, dword [ebp - 0x14]
jmp 0x1009ec10
mov esi, dword [esi + 0x18]
jmp 0x1009ecbe
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x1009ecf6
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1009ecec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009ecec
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d2309
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d1e89
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1009ed20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d569d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100f8040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
vpxor xmm0, xmm0, xmm0
xor edx, edx
mov dword [ebp - 0x2c], 1
mov edi, 0xf
mov dword [ebp - 0x18], edx
vmovdqu xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], eax
cmp esi, eax
je 0x1009ee2c
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1009eda3
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1009ed91
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.10037cc0
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1009edbd
cmp edi, 0xf
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x1009edca
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10047470
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
xor eax, eax
test edx, edx
je 0x1009ee04
mov esi, dword [ebp - 0x34]
nop dword [eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x1009edf0
mov esi, dword [ebp - 0x30]
cmp edi, dword [ebp + 8]
jne 0x1009ee14
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1009ee27
dec eax
mov dword [ebp - 0x2c], eax
add esi, 0x1c
mov dword [ebp - 0x30], esi
cmp esi, dword [ebp - 0x38]
je 0x1009ee2c
mov edi, dword [ebp - 0x14]
jmp 0x1009ed80
mov esi, dword [esi + 0x18]
jmp 0x1009ee2e
xor esi, esi
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x1009ee66
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1009ee5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1009ee5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d2309
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d1e89
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100a0770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100a079b
push 0
push 0
push 0
push 0x100445d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100a079b
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x100b4be0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100b4d71
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100b4d71
mov eax, dword [0x10451828]
cmp dword [eax + 0x174], 0xffffffff
je 0x100b4d71
mov eax, dword [0x10459514]
add eax, 0xffffff8e
xor eax, 0x1f2af9a
cmp dword [eax + ebx], 0
mov eax, dword [0x104594dc]
setle cl
add eax, 0xffffff9c
xor eax, 0x1f2af8c
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x104594d0]
add eax, 0xffffff9f
xor eax, 0x1f2af89
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x104594d4]
add eax, 0xffffff9e
xor eax, 0x1f2af8a
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x104594d8]
lea eax, [ecx - 0x63]
xor eax, 0x1f2af8b
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100b4cce
lea eax, [ecx - 0x63]
xor eax, 0x1f2af8b
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100b4cc6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100b4cba
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100b4cb7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x104594d8]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100b4c83
lea eax, [ecx - 0x63]
xor eax, 0x1f2af8b
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x1045183c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100b4d62
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x100b4d26
xor edx, edx
test ecx, ecx
je 0x100b4d4c
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100b4d33
cmp edi, 0x79705c5e
je 0x100b4d57
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100b4d62
mov ecx, dword [ebp - 4]
jmp 0x100b4d10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100b4d64
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x10451994]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ce510
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100cef90
mov esi, dword [eax + 4]
test esi, esi
je 0x100ce5c5
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100ce58c
cmp eax, esi
jne 0x100ce584
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100ce594
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100ce594
cmp eax, esi
jne 0x100ce594
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.100356d0
push 0x5c
push esi
call fcn.100d2309
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ce6b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100ce81f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.100356d0
push 0x5c
push edi
call fcn.100d2309
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100ce77d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100ce730
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100ce815
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100ce791
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100ce794
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100ce815
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.100356d0
push 0x5c
push edi
call fcn.100d2309
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100ce826
cmp esi, eax
jne 0x100ce7e5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100ce7a0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100d18ee
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100d1915
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100d1918
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100d18ca
pop esi
leave
ret 8
Function at 0x405d10
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x405f50
sub esp, 0x20
movzx eax, byte [0xcc1f4e]
test al, al
jne 0x405f28
mov eax, dword [0xcc2250]
mov ecx, dword [esp + 0x2c]
imul eax, ecx
mov edx, dword [esp + 0x28]
add eax, edx
mov ebx, dword [esp + 0x24]
jmp 0x405de2
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea edx, [ebx + 4]
lea ecx, [ebx + 8]
add ebx, 0xc
mov edi, dword [esp + 0x1c]
mov edi, dword [edi]
xor eax, edi
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [edx]
xor ebp, edx
imul ebp, ebp, 0xc70f85e1
rol ebp, 0xf
imul ebp, ebp, 0x319bca41
mov ecx, dword [ecx]
xor esi, ecx
imul esi, esi, 0x319bca41
rol esi, 0xf
imul esi, esi, 0x8b421a21
mov edi, dword [ebx]
mov ecx, dword [esp + 0x10]
xor edi, ecx
imul edi, edi, 0x8b421a21
rol edi, 0xf
imul edi, edi, 0xbce2d621
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
mov edx, dword [esp + 0x14]
lea ebx, [edx + 0x10]
mov edx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x405d54
xor eax, ebp
xor eax, esi
xor eax, edi
test ecx, ecx
je 0x405f21
cmp ecx, 4
jb 0x405eea
je 0x405ed5
cmp ecx, 8
jbe 0x405ea7
cmp ecx, 0x10
jbe 0x405e24
mov ebp, dword [0xcc2254]
imul ebp, edx
mov esi, dword [0xcc2258]
imul esi, edx
mov edi, dword [0xcc225c]
imul edi, edx
jmp 0x405dd3
mov edx, ebx
lea ebp, [ebx + 4]
lea esi, [ecx + ebx - 8]
lea ecx, [ecx + ebx - 4]
mov edx, dword [edx]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov edx, dword [ebp]
xor edx, eax
imul edx, edx, 0xbce2d621
rol edx, 0xf
imul edx, edx, 0xc70f85e1
mov eax, dword [esi]
xor eax, edx
imul eax, eax, 0xbce2d621
rol eax, 0xf
imul eax, eax, 0xc70f85e1
mov ecx, dword [ecx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, ecx
shr ecx, 0x11
xor eax, ecx
imul eax, eax, 0x319bca41
mov ecx, eax
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0x8b421a21
mov ecx, eax
shr eax, 0x10
xor eax, ecx
mov dword [esp + 0x30], eax
add esp, 0x20
ret
mov edx, ebx
lea ebx, [ecx + ebx - 4]
mov ecx, dword [edx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
mov eax, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405e7e
mov ecx, dword [ebx]
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405e7e
mov edx, ecx
shr ecx, 1
mov ebp, ebx
lea esi, [ecx + ebx]
lea edx, [edx + ebx - 1]
movzx ecx, byte [ebp]
xor ecx, eax
movzx eax, byte [esi]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
shl eax, 0x10
xor ecx, eax
imul ecx, ecx, 0xbce2d621
rol ecx, 0xf
imul ecx, ecx, 0xc70f85e1
jmp 0x405e7e
mov ecx, eax
jmp 0x405e7e
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call fcn.0044d690
mov eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
add esp, 0x20
ret
call fcn.0044c200
jmp fcn.00405d10
Function at 0x40ed00
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40eec8
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40eead
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call fcn.0044dca0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x24]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
jne 0x40eec1
cmp ecx, 0x21
jae 0x40eec1
mov dword [esp + 0x10], esi
lea ebp, [0xb92320]
movsd xmm0, qword [ebp + ebx*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebp + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call fcn.00448c40
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00448d30
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm2, xmm1
movsd xmm1, qword [0x9af9c0]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x9afa70]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40ee88
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x9afb18]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40ed2d
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call fcn.00426a70
ud2
call fcn.0044c200
jmp fcn.0040ed00