joyce8/EMBER2024-capa huggingface dataset:
Function at 0x512630
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x51279d
lea eax, [ecx - 1]
mov esi, dword [0x8cca4c]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x8cca54
lea eax, [edi + edi]
push eax
call fcn.004355d0
mov eax, dword [0x8cca4c]
lea ebx, [edi - 1]
mov dword [0x8cca60], ebx
mov dword [0x8cca64], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x512794
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x8cca54]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x5126f2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x51275f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x51272c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x512724
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x51275f
cmp ebx, edx
je 0x51273c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x512770
cmp ebx, edx
jne 0x512730
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x512794
mov ebx, dword [0x8cca60]
jmp 0x5126a0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x51275f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.00521ff6
int3
Function at 0x5129b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x512aea
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x14], ecx
lea eax, [edi + edi]
push eax
call fcn.004355d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x512abd
mov bl, byte [eax + 8]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0xc], edx
cmp edi, esi
jne 0x512a49
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x512ab3
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x512a80
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x512a78
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x512ab3
cmp edi, edx
je 0x512a90
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x512ac6
cmp edi, edx
jne 0x512a84
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x512a15
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x512ab3
push str.invalid_hash_bucket_count
call fcn.00521ff6
int3
Function at 0x517c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56846d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5ca1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x10], edx
jbe 0x517c87
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x517cab
mov ebx, dword [ebp - 0x10]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x517c96
mov ebx, dword [ebp - 0x1c]
push edi
push edx
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00435bd0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x517cdb
mov dword [ebx], eax
mov eax, ebx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x3ffffff
je 0x517e2c
lea eax, [esi + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x28], 0
call fcn.00524602
mov ebx, eax
add esp, 4
mov dword [ebp - 0x28], ebx
push dword [ebp - 0x18]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x10], esi
call fcn.00416820
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.004a5790
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x1c]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ecx
addsd xmm0, qword [eax*8 + 0x5ae9e0]
cvtdq2pd xmm1, xmm1
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5ae9e0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x517dcc
divss xmm0, xmm3
call fcn.00429be0
call fcn.00553a60
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x517db0
cmp eax, 0x200
jae 0x517dae
shl eax, 3
cmp eax, ecx
jae 0x517db0
mov eax, ecx
push eax
mov ecx, esi
call fcn.004353e0
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00435bd0
mov edx, dword [eax]
jmp 0x517dcf
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x2c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x517df9
mov dword [ecx + eax*8], ebx
jmp 0x517e0b
cmp esi, edx
jne 0x517e02
mov dword [ecx + eax*8], ebx
jmp 0x517e0f
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x517e0f
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp - 0x1c]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00521ff6
int3
Function at 0x519310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519384
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004be5c0
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519340
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x5193ae
test cl, 1
jne 0x5193ae
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x5193e7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004be5c0
test al, al
je 0x5193e7
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x5193b3
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x519400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519474
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004be670
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519430
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x51949e
test cl, 1
jne 0x51949e
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x5194d7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004be670
test al, al
je 0x5194d7
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x5194a3
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5194f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519564
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004be720
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519520
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x51958e
test cl, 1
jne 0x51958e
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x5195c7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004be720
test al, al
je 0x5195c7
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x519593
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5195e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519654
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004be9b0
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519610
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x51967e
test cl, 1
jne 0x51967e
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x5196b7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004be9b0
test al, al
je 0x5196b7
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x519683
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5196d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519744
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004bec40
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519700
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x51976e
test cl, 1
jne 0x51976e
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x5197a7
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004bec40
test al, al
je 0x5197a7
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x519773
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5197c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519834
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004bef80
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x5197f0
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x51985e
test cl, 1
jne 0x51985e
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x519897
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004bef80
test al, al
je 0x519897
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x519863
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x519a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov edi, eax
mov dword [ebp - 0xc], edx
sar edi, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x519ab4
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x188
add ecx, ebx
lea eax, [ecx - 0x188]
push eax
push ecx
call fcn.004f0dd0
imul ecx, dword [ebp - 8], 0x188
movzx eax, al
xor eax, 1
inc eax
add esi, eax
imul eax, esi, 0x188
add ecx, ebx
add eax, ebx
push eax
call fcn.00485b70
mov dword [ebp - 8], esi
cmp esi, edi
jl 0x519a70
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x519ade
test cl, 1
jne 0x519ade
imul eax, ecx, 0x188
imul ecx, esi, 0x188
add eax, 0xfffffe78
add eax, ebx
add ecx, ebx
push eax
call fcn.00485b70
mov edi, dword [ebp - 4]
cmp dword [ebp - 0xc], edi
jge 0x519b17
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x188
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.004f0dd0
test al, al
je 0x519b17
push dword [ebp - 4]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
mov edi, esi
cmp dword [ebp - 0xc], esi
jl 0x519ae3
push dword [ebp - 0x10]
imul ecx, edi, 0x188
add ecx, ebx
call fcn.00485b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x521194
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x5211bb
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x5211be
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00521170
pop esi
leave
ret 8

Function at 0x5253fc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x52543b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52543b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52543b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x52543b
cmp dword [ecx + 0x74], 0xe
jbe 0x52543b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x530630
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x10], 0
jne 0x53063d
xor al, al
ret
cmp dword [eax + 0x14], 7
jbe 0x530645
mov eax, dword [eax]
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x544a9c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x58ef38
push 0x58ef30
push str.FlsAlloc
push 0x1f
call fcn.005448c7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x544ad0
push dword [ebp + 8]
mov ecx, esi
call dword [0x56c4fc]
call esi
jmp 0x544ad6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x544b1a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x58ef48
push 0x58ef40
push str.FlsGetValue
push 0x21
call fcn.005448c7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x544b51
push dword [ebp + 8]
mov ecx, esi
call dword [0x56c4fc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x544b59
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x58ef50
push 0x58ef48
push str.FlsSetValue
push 0x22
call fcn.005448c7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x544b93
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x56c4fc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x5462c1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00525660
mov eax, dword [0x5ca1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00542672
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x546303
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x54645f
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00553480
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x5dbc38]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.00547148
mov ecx, dword [esi*4 + 0x5dbc38]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x546458
cmp eax, dword [ecx + edi + 0x24]
jne 0x546458
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x546458
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00547148
add esp, 0x14
test edx, edx
jl 0x546458
jg 0x5463ce
test eax, eax
jb 0x546458
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x546458
jl 0x5463e8
cmp dword [ebp - 0x1008], eax
ja 0x546458
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x546406
test ebx, ebx
je 0x54643f
cmp ecx, edi
jae 0x54643f
mov al, byte [ecx]
cmp al, 0xd
jne 0x546420
lea eax, [edi - 1]
cmp ecx, eax
jae 0x54642c
cmp byte [ecx + 1], 0xa
jne 0x54642c
inc ecx
jmp 0x54642c
movzx eax, al
movsx eax, byte [eax + 0x5ca4a8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x546406
cmp edx, ebx
jne 0x546406
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x54645d
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0052450f
leave
ret