joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2dd0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
push 0
push eax
call fcn.004c52c0
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4b2e37
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b2eb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8cab
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x53ba20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 8]
push 0x14
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.004c3423
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 4], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [ebx + 4]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.004663e0
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x4b309a
movzx eax, byte [esi + 8]
lea edi, [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.004464d0
cmp dword [ebp - 0x1c], 0
jne 0x4b308f
cmp dword [ebx + 8], 0xccccccc
je 0x4b30b0
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
push 0x14
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], 0
call fcn.004c3423
mov ecx, dword [edi]
add esp, 4
mov dword [eax + 8], ecx
mov dword [ebp - 0x10], eax
lea edx, [eax + 8]
mov dword [ebp - 0x24], eax
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [edi + 8]
test eax, eax
je 0x4b2ff3
lock inc dword [eax + 4]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [edi + 8]
mov dword [edx + 8], eax
mov eax, dword [ebx + 8]
inc eax
mov byte [ebp - 4], 3
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x504470]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x504470]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x4b3072
mov ecx, ebx
call fcn.004b96c0
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov edi, dword [ebp + 8]
add eax, 8
push edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004464d0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
jmp 0x4b3078
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
push ecx
push edi
mov ecx, ebx
call fcn.004b9610
mov byte [ebp - 4], 1
mov esi, dword [esi]
cmp esi, dword [ebp - 0x14]
jne 0x4b2f54
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x504420
call fcn.004c17da
int3
Function at 0x4b8800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 2
mov esi, ecx
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0x88]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esi + 0x98]
lea edi, [edx + eax*8]
mov eax, dword [edi]
mov eax, dword [eax + 0x7c]
cmp dword [eax - 0xc], 0
jne 0x4b8852
push 0x10
push 0x4fc6f4
push 0x516ba0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x38
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0x3c
push 0
push eax
call fcn.004c52c0
mov eax, dword [edi]
add esp, 0xc
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], 0x5153ec
mov dword [ebp - 0x38], 0xc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b9490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x4b95eb
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0044bfc0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4b95be
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x4b9544
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x4b95b1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x4b957e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x4b9576
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x4b95b1
cmp ebx, edx
je 0x4b958e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x4b95c7
cmp ebx, edx
jne 0x4b9582
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x4b94f2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4b95b1
push 0x50443c
call fcn.004c17da
int3
Function at 0x4b9a70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.004464d0
mov esi, dword [eax + 4]
test esi, esi
je 0x4b9b49
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x4b9af0
cmp eax, esi
jne 0x4b9ae8
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x4b9af8
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x4b9af8
cmp eax, esi
jne 0x4b9af8
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x4b9b30
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4b9b30
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4b9b30
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x14
push esi
call fcn.004c3279
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb670
Capabilities:
Create thread

Disassembly:
push 0x53b7a0
push 0
push 0
push 0x4fc6f4
push dword [0x555ec8]
mov ecx, 0x57036c
call fcn.0044c800
mov byte [0x570338], al
test al, al
je 0x4bb760
cmp byte [0x5703a8], 0
jne 0x4bb760
push esi
push 0
push 0
push 0
push 0x4fc6f4
push dword [0x555ec8]
mov ecx, 0x57036c
call fcn.00450890
push 0x57033c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x570354], eax
call esi
push 0
push 0
push 0
push 0x4bc1f0
push 0
push 0
mov dword [0x57035c], eax
call fcn.004d6048
add esp, 0x18
mov dword [0x570358], eax
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4bbe50
push 0
push 0
mov dword [0x570364], eax
call fcn.004d6048
push 0
push 0
push 0
push 0x4bc980
push 0
push 0
mov dword [0x570360], eax
call fcn.004d6048
add esp, 0x30
mov dword [0x570368], eax
mov al, byte [0x570338]
mov byte [0x5703a8], 1
pop esi
ret
Function at 0x4be330
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f93b0
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x22c], eax
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
or ebx, 0x2001f
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
lea edx, [ebp - 0x224]
mov dword [ebp - 0x224], 0
push edx
push ebx
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
mov eax, dword [ebp - 0x21c]
test esi, esi
jne 0x4be4e2
xor esi, esi
test eax, eax
je 0x4be3d4
push eax
call edi
mov esi, eax
mov eax, dword [ebp - 0x224]
and ebx, 0x300
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], ebx
test esi, esi
jne 0x4be4e2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [ebp - 0x234]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0x100
push ecx
lea ecx, [ebp - 0x210]
push ecx
push esi
push eax
call ebx
test eax, eax
jne 0x4be47b
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x21c]
call fcn.004be330
mov esi, eax
test esi, esi
jne 0x4be4dc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x220], 0x100
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x21c]
call ebx
test eax, eax
je 0x4be430
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4be492
push eax
call edi
mov dword [ebp - 0x21c], 0
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x218], 0
call fcn.004bd700
mov ecx, dword [ebp - 0x21c]
mov esi, eax
test ecx, ecx
je 0x4be4bc
push ecx
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4be4bc
push eax
jmp 0x4be4ba
Function at 0x4be690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f93fb
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x4be73c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x4be73c
call fcn.004bd630
mov edi, eax
jmp 0x4be85b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4be75f
call fcn.004bd630
jmp 0x4be84e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x4be77d
call fcn.004bd630
jmp 0x4be84e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x4be79e
mov edi, 0x8007000e
jmp 0x4be850
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x4be894
jb 0x4be7bc
cmp eax, 0xffffffff
ja 0x4be894
cmp eax, 0x400
jbe 0x4be7d1
push eax
lea ecx, [ebp - 0x418]
call fcn.0045e310
jmp 0x4be7f7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x4be7f7
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x4be80e
mov edi, 0x8007000e
jmp 0x4be850
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4be82e
call fcn.004bd630
jmp 0x4be84e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004be4f0
mov edi, eax
test esi, esi
je 0x4be85b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4be874
lea ecx, [ebp - 0x418]
call fcn.00402910
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0042d2e0
int3
Function at 0x4c4726
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4c4765
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c4765
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c4765
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4c4765
cmp dword [ecx + 0x74], 0xe
jbe 0x4c4765
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4c905a
Capabilities:
Encode data using xor

Disassembly:
adc eax, ecx
rol byte [0xc1d3f755], 0xc2
adc al, 0x87
ror dword [esi + 0x33], 1
fmul dword [ebx + 0x33]
add eax, 0x571d8a

Function at 0x4c91a6
Capabilities:
Encode data using xor

Disassembly:
and ebp, dword [esi]
pop ebx
loopne 0x4c912c
rep insb byte es:[edi], dx
mov ah, 0x3a

Function at 0x4ca631
Capabilities:
Hash data using murmur3

Disassembly:
add ecx, edi
or edi, dword [0x571e26]
rol edx, 0xf
not esi
sub eax, dword [0x571da9]
not esi
ror edx, 0xf
sub ecx, edi
mov dword [0x57155d], 0xf6cb679b
dec ecx
and dword [0x57136c], esi
add dword [0x5714dc], edi
xchg ecx, edx
add dword [0x571824], edi
add dword [0x57185f], ebx
xor edi, 0xf38bf6ec
add ecx, 0xb000033c
add edx, 0x43be71b1
neg edx
or dword [0x5716e2], edx
ror edi, 0x1a
sub dword [0x571951], edx
inc esi
sub edi, 0x91eb77a5
sub dword [0x571771], esi
xor ebx, dword [0x571df7]
rol edi, 5
add eax, dword [0x571d41]
not edi
inc eax
xor ebx, 0x1457ff9a
rol eax, 0xa
sub eax, 0x5f87740a
add eax, 0x5f87740a
ror eax, 0xa
xor ebx, 0x1457ff9a
Function at 0x4ca6d0
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
not edi
ror edi, 5
or dword [0x571567], edi
add edi, 0x91eb77a5
dec esi
xor dword [0x57171f], edi
rol edi, 0x1a
neg edx
sub edx, 0x43be71b1
sub ecx, 0x60250c97
add eax, dword [0x571d6e]
sub ebx, dword [0x571a19]
add ecx, eax
xchg ebx, edx
neg eax
xor eax, ebx
sub eax, edx
rol edx, 0x1b
not eax
xchg ebx, edx
ror edi, 0x12
add ecx, 0x837ad69d
xchg ebx, esi
mov dword [0x5713fb], ebx
mov dword [0x57188b], eax
sub dword [0x571742], edi
xchg ebx, esi
sub ecx, 0x837ad69d
rol edi, 0x12
xchg ebx, edx
not eax
ror edx, 0x1b
add eax, edx
xor eax, ebx
neg eax
xchg ebx, edx
sub ecx, eax
push ecx
neg ecx
call fcn.004b7020
not ecx
xor esi, edx
call fcn.0048fd3a
xor esi, ebx
xor dword [0x5717fc], eax
call fcn.004c5986
sbb byte [edx - 0x3d7e0001], dh
std
sub al, 0x2a
loopne 0x4ca776
sbb eax, 0x571620
xor dword [0x5718fe], 0xc952c5ca
xor eax, dword [0x571e06]
dec edi
add ebx, dword [0x571f50]
xor edx, dword [0x5719a6]
xor dword [0x571813], edx
push edi
add cl, al
into
sbb al, byte [ebx]
xor eax, 0x571eb3
add dword [0x571443], edi
dec ebx
rol esi, 0x16
ror esi, 0x16
inc ebx
rol esi, 0x1a
inc edi
sub dword [0x5718e2], edi
sub edx, 0xe02a2cfd
call fcn.00429edb
mov dword [0x571446], edx
xor esi, ebx
xor esi, edx
not ecx
neg ecx
mov edx, 0xd45756a3
sub ecx, ebp
or dword [0x57133c], edi
add edx, ebx
neg edi
or edx, dword [0x571a71]
sub ecx, esi
xor esi, 0x524523d8
rol edi, 0x12
call fcn.00441cb2
xor eax, esp
add eax, dword [0x571af9]
sub esi, ebp
add dword [0x5716b8], ebx
rol ebx, 0xf
not ecx
rol esi, 7
add esi, dword [0x571971]
ror esi, 7
not ecx
ror ebx, 0xf
xor dword [0x5715c1], edi
add esi, ebp
xor eax, esp
ror edi, 0x12
xor esi, 0x524523d8
add ecx, esi
neg edi
sub edx, ebx
and dword [0x57130e], edi
add ecx, ebp
xor edx, 0x718213da
call fcn.004a69dc
neg esi
mov dword [0x571883], ebx
xchg ecx, eax
add edx, 0x617bee9c
sub ecx, esi
call fcn.00459178
xor edi, 0xcb3ca4b
xor eax, dword [0x57199d]
add eax, ebp
ror edx, 0x13
not ecx
xor ebx, 0x3de7862a
xor ebx, 0x3de7862a
not ecx
rol edx, 0x13
sub eax, ebp
xor edi, 0xcb3ca4b
call fcn.004ad206
add ecx, esi
sub edx, 0x617bee9c
jnp 0x4ca901
xchg ecx, eax
add dword [0x5717c7], edi
neg esi
call fcn.0042e8f5
xor edx, 0xa5d57579
or dword [0x57153e], edx
ror esi, 0x18
xor ebx, 0x9d028fbd
dec esi
call fcn.0049bd2e
or dword [0x57140f], edx
neg eax
Function at 0x4ca76a
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
not edi
ror edi, 5
or dword [0x571567], edi
add edi, 0x91eb77a5
dec esi
xor dword [0x57171f], edi
rol edi, 0x1a
neg edx
sub edx, 0x43be71b1
sub ecx, 0x60250c97
add eax, dword [0x571d6e]
sub ebx, dword [0x571a19]
add ecx, eax
xchg ebx, edx
neg eax
xor eax, ebx
sub eax, edx
rol edx, 0x1b
not eax
xchg ebx, edx
ror edi, 0x12
add ecx, 0x837ad69d
xchg ebx, esi
mov dword [0x5713fb], ebx
mov dword [0x57188b], eax
sub dword [0x571742], edi
xchg ebx, esi
sub ecx, 0x837ad69d
rol edi, 0x12
xchg ebx, edx
not eax
ror edx, 0x1b
add eax, edx
xor eax, ebx
neg eax
xchg ebx, edx
sub ecx, eax
push ecx
neg ecx
call fcn.004b7020
not ecx
xor esi, edx
call fcn.0048fd3a
xor esi, ebx
xor dword [0x5717fc], eax
call fcn.004c5986
sbb byte [edx - 0x3d7e0001], dh
std
sub al, 0x2a
loopne 0x4ca776
sbb eax, 0x571620
xor dword [0x5718fe], 0xc952c5ca
xor eax, dword [0x571e06]
dec edi
add ebx, dword [0x571f50]
xor edx, dword [0x5719a6]
xor dword [0x571813], edx
push edi
add cl, al
into
sbb al, byte [ebx]
xor eax, 0x571eb3
add dword [0x571443], edi
dec ebx
rol esi, 0x16
ror esi, 0x16
inc ebx
rol esi, 0x1a
inc edi
sub dword [0x5718e2], edi
sub edx, 0xe02a2cfd
call fcn.00429edb
mov dword [0x571446], edx
xor esi, ebx
xor esi, edx
not ecx
neg ecx
mov edx, 0xd45756a3
sub ecx, ebp
or dword [0x57133c], edi
add edx, ebx
neg edi
or edx, dword [0x571a71]
sub ecx, esi
xor esi, 0x524523d8
rol edi, 0x12
call fcn.00441cb2
xor eax, esp
add eax, dword [0x571af9]
sub esi, ebp
add dword [0x5716b8], ebx
rol ebx, 0xf
not ecx
rol esi, 7
add esi, dword [0x571971]
ror esi, 7
not ecx
ror ebx, 0xf
xor dword [0x5715c1], edi
add esi, ebp
xor eax, esp
ror edi, 0x12
xor esi, 0x524523d8
add ecx, esi
neg edi
sub edx, ebx
and dword [0x57130e], edi
add ecx, ebp
xor edx, 0x718213da
call fcn.004a69dc
neg esi
mov dword [0x571883], ebx
xchg ecx, eax
add edx, 0x617bee9c
sub ecx, esi
call fcn.00459178
xor edi, 0xcb3ca4b
xor eax, dword [0x57199d]
add eax, ebp
ror edx, 0x13
not ecx
xor ebx, 0x3de7862a
xor ebx, 0x3de7862a
not ecx
rol edx, 0x13
sub eax, ebp
xor edi, 0xcb3ca4b
call fcn.004ad206
add ecx, esi
sub edx, 0x617bee9c
jnp 0x4ca901
xchg ecx, eax
add dword [0x5717c7], edi
neg esi
call fcn.0042e8f5
xor edx, 0xa5d57579
or dword [0x57153e], edx
ror esi, 0x18
xor ebx, 0x9d028fbd
dec esi
call fcn.0049bd2e
or dword [0x57140f], edx
neg eax
Function at 0x4ca782
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
not edi
ror edi, 5
or dword [0x571567], edi
add edi, 0x91eb77a5
dec esi
xor dword [0x57171f], edi
rol edi, 0x1a
neg edx
sub edx, 0x43be71b1
sub ecx, 0x60250c97
add eax, dword [0x571d6e]
sub ebx, dword [0x571a19]
add ecx, eax
xchg ebx, edx
neg eax
xor eax, ebx
sub eax, edx
rol edx, 0x1b
not eax
xchg ebx, edx
ror edi, 0x12
add ecx, 0x837ad69d
xchg ebx, esi
mov dword [0x5713fb], ebx
mov dword [0x57188b], eax
sub dword [0x571742], edi
xchg ebx, esi
sub ecx, 0x837ad69d
rol edi, 0x12
xchg ebx, edx
not eax
ror edx, 0x1b
add eax, edx
xor eax, ebx
neg eax
xchg ebx, edx
sub ecx, eax
push ecx
neg ecx
call fcn.004b7020
not ecx
xor esi, edx
call fcn.0048fd3a
xor esi, ebx
xor dword [0x5717fc], eax
call fcn.004c5986
sbb byte [edx - 0x3d7e0001], dh
std
sub al, 0x2a
loopne 0x4ca776
sbb eax, 0x571620
xor dword [0x5718fe], 0xc952c5ca
xor eax, dword [0x571e06]
dec edi
add ebx, dword [0x571f50]
xor edx, dword [0x5719a6]
xor dword [0x571813], edx
push edi
add cl, al
into
sbb al, byte [ebx]
xor eax, 0x571eb3
add dword [0x571443], edi
dec ebx
rol esi, 0x16
ror esi, 0x16
inc ebx
rol esi, 0x1a
inc edi
sub dword [0x5718e2], edi
sub edx, 0xe02a2cfd
call fcn.00429edb
mov dword [0x571446], edx
xor esi, ebx
xor esi, edx
not ecx
neg ecx
mov edx, 0xd45756a3
sub ecx, ebp
or dword [0x57133c], edi
add edx, ebx
neg edi
or edx, dword [0x571a71]
sub ecx, esi
xor esi, 0x524523d8
rol edi, 0x12
call fcn.00441cb2
xor eax, esp
add eax, dword [0x571af9]
sub esi, ebp
add dword [0x5716b8], ebx
rol ebx, 0xf
not ecx
rol esi, 7
add esi, dword [0x571971]
ror esi, 7
not ecx
ror ebx, 0xf
xor dword [0x5715c1], edi
add esi, ebp
xor eax, esp
ror edi, 0x12
xor esi, 0x524523d8
add ecx, esi
neg edi
sub edx, ebx
and dword [0x57130e], edi
add ecx, ebp
xor edx, 0x718213da
call fcn.004a69dc
neg esi
mov dword [0x571883], ebx
xchg ecx, eax
add edx, 0x617bee9c
sub ecx, esi
call fcn.00459178
xor edi, 0xcb3ca4b
xor eax, dword [0x57199d]
add eax, ebp
ror edx, 0x13
not ecx
xor ebx, 0x3de7862a
xor ebx, 0x3de7862a
not ecx
rol edx, 0x13
sub eax, ebp
xor edi, 0xcb3ca4b
call fcn.004ad206
add ecx, esi
sub edx, 0x617bee9c
jnp 0x4ca901
xchg ecx, eax
add dword [0x5717c7], edi
neg esi
call fcn.0042e8f5
xor edx, 0xa5d57579
or dword [0x57153e], edx
ror esi, 0x18
xor ebx, 0x9d028fbd
dec esi
call fcn.0049bd2e
or dword [0x57140f], edx
neg eax