joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490617
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edx
pop edx
push 0x67c9643d
pop eax
rol eax, 2
jmp 0x4adaea
add eax, 0x6123ca0a
xchg dword [esp], eax
jmp 0x493605

Function at 0x491d73
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], ebx
pop ebx
add eax, 0x85634b9f
add eax, ebp
add eax, 0x6277fc54
mov eax, dword [eax]
mov al, byte [eax]
jmp 0x49703f
jns 0x4ab205
sub al, 0x99
push 0x4b0d0b
jmp 0x49b290
jmp 0x496f44
ret
sub al, 0x99
mov edx, dword [ebp - 4]
imul byte [edx]
call fcn.0049b1e2

Function at 0x492a39
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
je 0x4ad6a8
jmp 0x4a9227
pop esi
rol esi, 4
or esi, 0x2fabaf7c
add esi, 0xe740f314
add esi, ebp
jmp 0x4ba5ff
pop esi
popfd
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
jmp 0x491f8f
jmp 0x4b2471
ret
push 0x498719
jmp 0x48e2b7
jmp 0x4b7d69
push 0xfaa805ee
pop eax
jmp 0x49f70b
jno 0x48d8b7
push 0x4a974e
jmp 0x4b7d5f
test eax, 0x40000000
jmp 0x48b563
add esi, 0x18d34d6a
mov dword [esi], eax
add esi, eax
jmp 0x48cff3
and eax, 0x8c940609
add eax, 0x4b47e8aa
jae 0x4b8d19
shr ebx, 0x11
jmp 0x4b8d0c
jmp 0x48cdda
je 0x4b0432
jmp 0x491e9c
jmp 0x493a8c
or eax, 0xd056efc5
add eax, 0xdd419c3
mov eax, dword [eax]
pushfd
push esi
push 0xadae2325
jmp 0x4a3422
jmp fcn.0049970d
add ebx, 0x64917f7b
xchg dword [esp], ebx
jmp 0x4ae59a
ret
jmp 0x48ef21
add esp, 0xffffffec
cmp dword [0x4b19a0], 0
jne 0x49257c
jmp loc.0047e140
cdq
add esi, 0x5d907bba
add ebp, 0x9efea5d3
xor eax, 0xe1a533aa
jmp 0x4ab2fc
jmp 0x49da36

Function at 0x494dec
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp 0x4965b8
rol eax, 9
jmp 0x4b696f
jns 0x47d4e0
jl 0x4ace18
cdq
jl 0x480293
and esi, ebx
add ecx, 0x35904ba
add ecx, eax
call fcn.0047f75c
call fcn.0049d014
mov edx, 0x7da6acc0
call fcn.004b99c6
push eax
ror eax, 0xd
push 0x4a09d0
jmp 0x4a42a9
xchg dword [esp], ecx
pop ecx
mov eax, dword [ebp - 8]
jmp 0x49f49d
xor edx, edx
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 8]
xor edx, edx
jmp 0x4a2441
rol eax, 0xd
push edi
mov edi, eax
xchg dword [esp], edi
call fcn.0049b9d3
jmp 0x4ab973
je 0x49492b
jmp 0x4b60ed
jmp 0x4ae5e3
jmp 0x4b2a11
jmp 0x4b1373
ret
pop ebx
mov eax, dword [0x4afdb4]
or eax, eax
jne 0x4a09dc
jmp 0x4afc88
push ecx
push 0xb2601d92
pop ecx
or ecx, 0x599f69ff
xor ecx, 0xcdd48503
add ecx, 0x72f8314b
and ecx, 0x94dcb459
cmp ecx, 0x8100e86f
jmp 0x4a9b5f
jmp 0x4a0f8b
jl 0x48b848
cmp ebx, 0x97c646fe
jmp 0x48b833
ret
sub edi, 0x58741026
adc ebx, ebp
jmp 0x49492b
jmp 0x4b4c42
Function at 0x495293
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol edi, 0x1d
and edi, 0x2b04003f
or edi, 0x982bedc3
call fcn.004ba7ba
mov ebp, esp
push ecx
mov esp, ebp
pop ebp
mov eax, dword [0x4a4538]
jmp 0x49756a
jmp 0x4a0ec9
jmp 0x4babe5
rol ecx, 0x16
adc ecx, edx
jmp 0x4b770f
jno 0x497396
push ebp
jmp 0x4b792c
push ebp
mov ebp, esp
push ecx
call fcn.004aec1e
jmp 0x4bbd5f
or eax, eax
jne 0x4afc5a
jmp 0x4a39ad
add eax, 0x7d14e593
push 0x4bae80
jmp 0x48b943
ret
je 0x4b770f
jmp 0x48edfa
jmp 0x4a2308
xor ecx, 0xe56a47c3
add ecx, 0x1bdb8c15
popfd
xchg dword [esp], ecx
jmp 0x4b392d
xchg dword [esp], ebx
mov eax, ebx
pop ebx
or eax, 0x3b4bce21
cmp eax, 0x33a8d4cf
jmp 0x48d2bc
sbb esi, ebp
and eax, 0x5e7381c0
jne 0x49c933
rol eax, 0x10
push eax
call fcn.004b2542
jmp 0x4a6733
jmp fcn.004b99c6
push ebx
push 0x386c4d21
pop ebx
xor ebx, 0x7b422bf3
add ebx, 0xbd1967d4
jmp 0x499ebd
jmp 0x48b711
jge 0x4aada6
and ebp, edi
sub eax, 0xd6c861be
jmp 0x4aada4
pop edi
sub edi, 0x11f52f6f
jne 0x47c2f1
jmp 0x4a4752

Function at 0x495a11
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edx
pop edx
and ecx, ebx
xor ecx, 0x479b3602
jno 0x4bc85a
jmp 0x4b3823
push 0x48f8e9
jmp 0x4a6140
push ebx
pushfd
jmp 0x47bc5e

Function at 0x496386
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
popfd
call fcn.0048f0e7
pop ecx
push ebp
push 0xd347c98f
jmp 0x4add86
jmp 0x4a8fa4
add esi, 0xb1866482
adc edx, esi
jmp 0x4b813b
xchg dword [esp], eax
pop eax
imul byte [edx]
cmp al, 0xa4
je 0x4a5521
jmp 0x4a2995
rol eax, 4
add eax, 0xcdccb289
add eax, ebp
add eax, 0x1b9615e7
mov eax, dword [eax]
jmp 0x48cade
jmp 0x4b883f
jmp 0x4a7531
jmp 0x4bb27d
xchg dword [esp], ebx
jmp 0x48e623
shr ebp, 7
xchg ebp, eax
adc ebx, 0x178337c1
jmp 0x4a878f
shr edx, 0xe
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jne 0x4a5526
jmp 0x4aa1f9
push ebx
pop ecx
push 0x4ba689
jmp 0x4ae7d3
je 0x4a5521
jmp 0x491b5a
jmp 0x49c88b
jae 0x49a5a2
push 0x55a7db83
jmp 0x4a5521
jne 0x4a8792
jmp 0x4a2c41
add ecx, 0x165493bc
pushfd
push 0xc169d378
pop eax
jmp 0x4b575c

Function at 0x496865
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jmp 0x4aebb5
xchg dword [esp], ecx
pop ecx
call fcn.0048a3d2
jmp 0x495e62

Function at 0x497e4d
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], edi
pop edi
push eax
mov eax, dword [ebp - 0x14]
push ebp
mov ebp, eax
call fcn.004903d3
jmp loc.0047fc22

Function at 0x498432
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ebx
pop ebx
lea eax, [fcn.00496149]
jmp loc.004800fc

Function at 0x498e8d
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edx
pop edx
add ebx, 0x134bdab0
xchg dword [esp], ebx
jmp 0x4b49b3
jmp fcn.00492a39
Function at 0x49904b
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [sym.imp.USER32.dll_GetSysColor], eax
call fcn.0048c8ae
pop ebx
mov eax, dword [ecx]
jmp 0x49e6ee
jmp 0x48b0e1
jge 0x4ad2e0
test eax, ebp
jmp 0x4a7a59
jne 0x4a7a5f
jmp 0x4a4b1d
jmp 0x497d78
pop edi
add edi, 0x13996c40
and edi, 0x36344b8
rol edi, 1
and edi, 0x7a86d2d1
jmp 0x4b3576
jne 0x49e6ee
jmp 0x48ce1c
js 0x4b4835
call fcn.00480ec3
test al, al
je 0x4a7a70
jmp 0x4921a2
jmp 0x4b825d
call fcn.00494509
jmp 0x4a8330
jge 0x4ab8a9
push 0x7530
call fcn.004b01a8
push 0
call fcn.00493437
ret
test ebp, 0xe53b17fe
jmp 0x48f527
mov eax, dword [esp]
push edx
call fcn.004ba6a0
mov eax, 0xa810778b
call fcn.004a5235
push edi
push 0x16a8ee6f
jmp 0x4b6452
jmp 0x4bc351
add eax, 0x97a4ade4
xchg dword [esp], eax
jmp 0x49c043
jmp 0x491d68
add edi, 0xffc2d578
mov dword [edi], eax
pop edi
lea eax, [0x4b825d]
mov byte [eax], 0xc3
jmp 0x4b825d
call fcn.00480ec3
test al, al
je 0x4a7a70
jmp 0x4b23f6
jmp 0x496748
pop edx
jno 0x4aac3e
mov eax, dword [esp]
push edx
call fcn.004ba6a0
mov eax, 0xa810778b
call fcn.004a5235
jmp 0x48d1f4
push eax

Function at 0x499754
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], eax
pop eax
pop esi
mov dword [ebp - 0x20], 0xffffffff

Function at 0x499d05
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], edx
pop edx
push edx
pop ebp
jmp 0x4bc84f
xchg dword [esp], ebp
mov edx, ebp
pop ebp
jmp 0x4b161e

Function at 0x49a4a6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
lea eax, [fcn.00491661]
mov byte [eax], 0xc3
jmp fcn.00491661

Function at 0x49a79a
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ebx
pop ebx
mov ebp, esp
push ecx
mov esp, ebp
jmp 0x49fe65

Function at 0x49d423
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], eax
or eax, 0x100
xchg dword [esp], eax
popfd
nop
jmp 0x4929ae
test ebx, esi
jmp loc.0047fd7a
jmp 0x49959d
jle 0x4af051
jmp 0x48c951
push dword fs:[0]
mov dword fs:[0], esp
jmp 0x4a2a2d
pushfd
jmp 0x4b498c
jmp loc.0047c790
jmp 0x48c6d6

Function at 0x49e2b0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp 0x4a90d6
add esi, 0x7d496260
xchg dword [esp], esi
jmp 0x4a2597
xchg dword [esp], ecx
pop ecx
popfd
push esi
mov esi, eax
jmp 0x4a09ef
and esi, 0x8346a81d
jne 0x49a0d4
rol edi, 0xe
pushfd
jmp 0x4a1725
xchg dword [esp], esi
push esi
push 0xaba025a9
pop esi
jmp 0x49eccb
js 0x47c3ce
xor edx, 0x326b670f
jmp 0x49a0d4
jmp fcn.004a1ce4

Function at 0x49e8fd
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], eax
pop eax
rol eax, 0x1f
push edx
jmp 0x4a0a26
push 0x1426cc70
pop edx
or edx, 0x28353bd0
sub edx, 0x8e340614
rol edx, 6
xor edx, 0xfa72f4e2
add edx, 0x9c9122f9
jmp 0x4aa138
jmp 0x4aeb10
xor eax, edx
call fcn.0048e0f4
sub ebx, 0x9a32bb3f
cdq
jmp fcn.004a82c8
Function at 0x4a0d86
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], esi
pop esi
mov eax, dword [eax]
mov eax, dword [eax + 0x64]
jmp 0x4b400e
jmp loc.004819a5

Function at 0x4a122e
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ecx
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
shl dword [ebp - 8], 8
jmp 0x4a2b62

Function at 0x4a18b5
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], eax
pop eax
mov eax, 0x10
call fcn.0049332f
test al, al
je 0x4abea6
jmp loc.00481d61
xchg dword [esp], ebx
mov ebp, ebx
xchg dword [esp], edi
mov ebx, edi
pop edi
jmp 0x4a4480
jmp 0x4a4794
ret
mov esp, ebp
jmp 0x4a1a74

Function at 0x4a4a9a
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
jae 0x4b4f13
add esp, 0xfffffff4
push ecx
mov ecx, ebx
jmp 0x47abf2
add esp, 0xfffffff4
push esi
mov esi, ebx
jmp 0x4bb68c
xchg dword [esp], esi
push esi
push 0x7824ba88
pop esi
or esi, 0x939f9a6d
and esi, 0x84455193
jmp 0x480eef
jmp 0x4b8ede

Function at 0x4a4b4d
Capabilities:
Hash data using murmur3

Disassembly:
jmp fcn.0048f3ef
xchg dword [esp], esi
pop esi
mov eax, dword [esp]
push edx
push ecx
push 0xa71434ac
jmp 0x4b17d1
pop ecx
and ecx, 0x104551f0
rol ecx, 0xd
and ecx, 0x35055685
add ecx, 0x45308e
xchg dword [esp], ecx
jmp 0x496763

Function at 0x4a4f36
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push edi
push 0xfe62e04e
pop edi
or edi, 0xe502612b
add edi, 0xe8a10d
jmp loc.00495f10
rol eax, 0x16
push esi
jmp fcn.004b8204
je 0x47e7c6
jmp 0x4911a8
js 0x499953
cdq
push ecx
jmp loc.0047e7c5
call fcn.004b7c33
pop ecx
jmp loc.00480de2
xchg dword [esp], ecx
pop ecx
mov eax, dword [0x4a456c]
or eax, eax
jne 0x48ec64
jmp 0x4afd9c
jmp 0x48fd76
Function at 0x4a5235
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
cmp dword [ebp - 4], 0
jne 0x48ec1a
lea eax, [ebp - 0x125]
push eax
call fcn.004bc8dc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
call fcn.0047b14a
jmp 0x4bbf74
jmp 0x4aebb5
jmp 0x4980c6
jmp 0x4b5a90
lea eax, [ebp - 0x125]
push eax
call fcn.004aae07
mov dword [ebp - 4], eax
jmp 0x4b9c16
je 0x496ed5
lea eax, [ebp - 0x125]
push eax
call fcn.004aae07
jmp 0x4a28e4
call fcn.004a9765
mov byte [eax], 0
inc dword [ebp - 0x1c]
jmp 0x490bbd
add eax, 0x18
mov dword [ebp - 0x10], eax
jmp fcn.0047bec4
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je fcn.0047d6bd
mov eax, dword [ebp - 4]
call fcn.004bb400
jmp 0x4b41d2
je 0x49a63d
mov edx, dword [0x49a544]
jmp loc.0047cf18
je 0x49e5ef
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x493597
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x48ec1a
lea eax, [ebp - 0x125]
push eax
call fcn.004bc8dc
mov dword [ebp - 4], eax
jmp 0x48ec1a
cmp dword [ebp - 4], 0
je fcn.0047d6bd
mov eax, dword [ebp - 4]
add eax, 0x3c
mov eax, dword [eax]
add eax, dword [ebp - 4]
jmp 0x49e5e4
mov dword [ebp - 8], eax
jmp 0x48f332
jmp 0x48ec01
jmp 0x4b8891

Function at 0x4a5ea2
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], eax
pop eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp loc.0047d461

Function at 0x4a7633
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
lea eax, [ebp - 8]
push eax
xor eax, eax
call fcn.004a4a9a
jmp 0x4ae26c
jne fcn.0049be30
jmp 0x49eea0
jmp loc.0047e978
xchg dword [esp], esi
pop esi
mov eax, 1
call fcn.0047c6e1
test al, al
je 0x49b13d
jmp 0x49eaa5
push eax
push esi
mov esi, edi
xchg dword [esp], esi
push 0xcf3407b1
pop edi
add edi, 0x20ae5f
jmp fcn.004a3751

Function at 0x4a8172
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], edi
pop edi
add edx, 0xbb940cb0
xchg dword [esp], edx
jmp fcn.0048d967

Function at 0x4a92e7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp fcn.004b99c6
xchg dword [esp], ecx
pop ecx
push 0xc5d36958
pop ecx
rol ecx, 1
add ecx, 0x74a3c050
xchg dword [esp], ecx
jmp 0x49be92

Function at 0x4a9765
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add edx, 0xcf5f5a43
and edx, 0xac9745ed
xor edx, 0x2def991d
add edx, 0x7250cb68
jmp loc.004aad73
xchg dword [esp], eax
pop eax
push 0x3d4124e6
pop edx
and edx, 0x231ed291
cmp edx, 0x876c88c4
jmp 0x4b81fe
jge 0x47b33e
Function at 0x4aa1a6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push 0x27369f24
jmp loc.004b208b
jno 0x4b5e0d
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x73
je 0x49d6e2
jmp fcn.00499fc8
or eax, 0xf0589989
jbe 0x4bad9f
adc ecx, 0xfe6c8e5e
and edi, eax
jmp 0x4ab465
mov eax, dword [esp]
push ecx
jmp 0x4b8e44
je 0x480c4e
jmp 0x4aabf6
jmp 0x4ae49d
xor ecx, esi
ja fcn.0047c43b
jmp 0x49da09
inc dword [ebp - 0x1c]
push 0xf0303dda
pop eax
jmp 0x49fff9
pop esi
rol eax, 1
or eax, 0xbbbdda0d
push 0x4a116f
jmp loc.00480f9d
pop eax
jmp 0x4916b2
jmp 0x49302b
jmp 0x4b4a33
mov dword [edi], ebx
sub ecx, 0xbef18d33
mov eax, dword [ecx]
and esi, ebp
jmp 0x49efc3
add edx, 0xe5ee6586
jmp loc.0047ea62
jne 0x49efc3
jmp 0x4ba0ca
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x73
je 0x4bb418
jmp 0x4b7732
ret
jne 0x4ab467
jmp 0x48a973
je 0x49da09
jmp 0x493567
jns 0x49751b
inc dword [ebp - 0x1c]
jmp 0x4b5548
jno 0x4916bf
inc dword [ebp - 0x1c]
push 0x57fe6cda
pop eax
or eax, 0x381a4867
and eax, 0x7ce52bd3
add eax, 0x15c5d0d1
jmp 0x4a0e49
jne 0x4b1b28
push 0x49a478
jmp 0x4a3b07
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x52
jne 0x4a9e5c
jmp 0x499c70
jmp 0x4a1932
add eax, 0x444f9340
add eax, ebp
add eax, 0xbbf190ca
mov eax, dword [eax]
cmp byte [eax], 0x43
jne 0x4a9e5c
jmp 0x48fa8c
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x53
jne 0x4a9e5c
jmp 0x4a956c
jmp 0x4affb3
add eax, 0x84e27c10
sub eax, 0x3e528a1c
add eax, 0xbf8c372f
add eax, ebp
jmp 0x4bc6ff
jmp 0x4b08b7
jmp loc.00480591
push 0x207c77ee
xchg dword [esp], esi
mov eax, esi
mov esi, edi
jmp 0x4b4412
add edx, 0xd96db180
sbb edx, ebp
mov dword [ecx], edi
jmp 0x4a06da
je 0x49b87c
jmp 0x4b440d
xchg dword [esp], esi
pop esi
pop ebx
jne 0x48ef57
jmp 0x4b8a04
jno fcn.0049f0ad
sbb eax, edx
pop ebx
jmp fcn.00480c4a
xor esi, eax
push 0xd0cccbe7
pop eax
add eax, 0x29af658e
rol eax, 0x1e
jb 0x4b2ba6
jmp 0x4b4ee7
add eax, 0xd520126d
mov eax, dword [eax]
call fcn.004bc48f
add edi, 0x2c3a72b2
mov dword [edi], eax
push 0x49b359
jmp 0x4a4588
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x73
je 0x49b87c
jmp 0x4b8197
ret
add eax, ebp
add eax, 0x6d560640
mov eax, dword [eax]
cmp byte [eax], 0x72
je 0x49da09
jmp 0x496f28
ret
inc dword [ebp - 0x1c]
jmp 0x4ae0d0
sub eax, 0x2cbcef7a
add eax, 0xd8fdd094
add eax, ebp
jmp 0x4abee1
jmp loc.0047ddcc
jmp 0x492cb2
rol eax, 0xb
call fcn.0047f5e7
ja 0x4a01b8
push 0x4b7e8a
jmp 0x4996a0
jmp 0x4a487d
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0x73
je 0x49d6e2
jmp 0x499a8c
jne 0x47ea69
jmp 0x494d87
jne 0x4a06da
jmp 0x4a60c9
mov eax, dword [esp]
push 0x4b463f
jmp 0x490d28
mov ecx, edx
xchg dword [esp], ecx
call fcn.0048c261
push 0x4e17b6a9
pop eax
jmp 0x4936d5
jmp 0x4941db
jmp fcn.004b2291
jmp loc.0047ea73
Function at 0x4aae73
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add eax, 0x837928bb
rol eax, 0xb
xor eax, 0xac85a850
add eax, ebp
add eax, 0x8318b30
mov eax, dword [eax]
jmp loc.004b7872
rol edx, 0xd
xor edx, 0x5905595
sub edx, 0xdc4b6878
add edx, 0x5632798d
mov dword [edx], eax
call fcn.004a314d
jge 0x47a29c
jmp fcn.0049d0ad
xchg dword [esp], edi
pop edi
push edx
push 0xd81132a0
pop edx
sub edx, 0x523d1320
test edx, 0x1000
jmp 0x4b6262
jne 0x4a492e
jmp loc.0047ca75

Function at 0x4ac3ab
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
mov eax, dword [0x4ac0a4]
or eax, eax
jne 0x4962be
jmp 0x4af028
rol eax, 0xc
push edx
mov edx, eax
xchg dword [esp], edx
jmp 0x47addd
js 0x4b9624
jmp 0x4b0798
jmp 0x49a102
ret
push ebp
mov ebp, esp
push ecx
mov esp, ebp
pop ebp
jmp 0x4940d6
je 0x4b079a
jmp 0x49d5d1
mov edi, esi
push esi
push 0x48eb7d
jmp 0x4ab2f6

Function at 0x4ad08d
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol eax, 7
jmp 0x4a181f
jmp 0x4ab739
xchg dword [esp], edx
pop edx
pop ebp
mov eax, dword [0x4ac0e4]
or eax, eax
jne 0x47ec25
jmp 0x4a453c
Function at 0x4ad5d0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp 0x4a140c
pop ebp
mov eax, dword [esp]
push edi
mov edi, edx
xchg dword [esp], edi
jmp 0x4a3e6e
push 0xf685327
pop eax
sub eax, 0xb406778d
xor eax, 0xb76de6e7
and eax, 0xae49ca5f
js 0x49e24a
jl 0x47c3d6
jne 0x493d10
jmp 0x4bbdaf
push 0x483be93b
pop ebx
rol ebx, 0xa
jae 0x4a5686
mov ebp, 0x742c4478
jmp 0x4a38e2
jmp fcn.004b99c6
jne 0x4a27b6
ja 0x48dc49
cdq
adc esi, ecx
push 0x6073168c
pop eax
jmp 0x4bb561
ret
jmp 0x493d36
jbe 0x47ce85
add edx, 0x999558b8
popfd
xchg dword [esp], edx
jmp 0x48eba2
jmp 0x49dd59
add ecx, 0xd911497d
jmp 0x4a78c4
pop eax
and eax, 0xd3cddb62
rol eax, 0xf
xor eax, 0x2ecf062f
add eax, ebp
add eax, 0x39b1992f
jmp 0x4b7870
or ecx, 0xce38b982
and ecx, 0x55697f33
add ecx, 0xc9334b13
add ecx, ebp
add ecx, 0xf2a47bca
jmp 0x4adaa4
add eax, 0x5442b913
mov dword [ebp - 4], eax
jmp 0x47e418
jge 0x4a64b9
cmp ebp, 0xc533bc62
jmp 0x493d07
je 0x4b6567
jmp fcn.0048a132
jmp 0x4af276
rol eax, 0x16
and eax, 0xb66f0cee
add eax, 0x7f0eba7f
xor eax, 0xa517007f
add eax, ebp
add eax, 0x7ffe38e2
jmp 0x4a18df
jle 0x49a818
jmp 0x4b0617
jmp 0x4a8d22
js 0x48a11b
add ebx, 0x10a26844
mov dword [ebx], eax
xchg dword [esp], edi
mov ebx, edi
pop edi
push 0x4971f7
jmp 0x495e4e
test edi, eax
jmp 0x4aa08d
ror edx, 4
test edi, ecx
jmp 0x497c78
je 0x47d8a7
mov eax, 0x4ac170
mov dword [ebp - 4], eax
push ecx
mov ecx, edi
xchg dword [esp], ecx
push 0xa97d70b1
pop edi
jmp 0x4b47af
jne 0x4aabca
xor esi, 0x6004080e
add esi, 0xe1020eba
popfd
xchg dword [esp], esi
jmp fcn.00498f84
xchg dword [esp], eax
pop eax
add eax, 0xb99256e3
mov eax, dword [eax]
cmp dword [eax], 0
je 0x4b0f04
jmp 0x48ad2b
mov dword [ecx], eax
pop ecx
add dword [ebp - 4], 4
push 0xe5d7f10b
jmp 0x49ab7e
mov eax, dword [eax]
mov eax, dword [eax]
push ecx
push 0x4c84845b
pop ecx
and ecx, 0x8b881b
jmp 0x498fe0
xor ebp, 0x2e13eb0d
cmp edi, 0x242d0584
jmp 0x4a5680
mov eax, 0x3ff
call fcn.004b21c9
add eax, 0x3e8
push esi
mov esi, eax
xchg dword [esp], esi
call fcn.004b01a8
jmp 0x4a3968
add edi, 0xc34481b1
and edi, 0x852c3aca
or edi, 0xc9bb8869
test edi, 0x80
jmp 0x4b4de4
jmp 0x49f428
sub edi, 0x139ea01b
add edi, 0x462d82e9
xchg dword [esp], edi
jmp 0x4af042
mov eax, dword [eax]
or eax, 0x20309d1c
test eax, 0x20000000
jmp 0x492922
cmp eax, edi
jmp 0x49e980

Function at 0x4ae055
Capabilities:
Hash data using murmur3

Disassembly:
jne 0x49ee4c
push 0x300dc759
pop eax
rol eax, 6
jmp 0x4b5a76
or esi, 0xb833d4db
add esi, 0x451ee81
xchg dword [esp], esi
jmp 0x4a6582
push ebx
mov ebx, edx
xchg dword [esp], ebx
push esi
push 0x1d1a2aac
jmp 0x4a2c23
jmp 0x49faec
jmp 0x4ad5a8
ret
call fcn.0048ec6d
jmp 0x4b5c93
jmp fcn.004ba6a0
add esi, 0x74864411
add edi, esi
pop esi
mov dword [edi], eax
pop edi
je 0x49033b
jmp 0x4ae2a5
push 0x4b2208
jmp 0x4a59e5
pop esi
add esi, 0x5eab446a
test esi, 0x2000
jmp 0x48b648
xchg dword [esp], ebx
pop ebx
pop edx
jns 0x4b0904
mov eax, dword [esp]
jmp 0x4a6559
jmp 0x4ac795
mov eax, dword [esp]
jmp 0x4a2372
jmp 0x4ba9a3
jge 0x4ac4fe
jmp fcn.00492f96
test eax, 8
jmp loc.0047a2ba
Function at 0x4aebac
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ecx
pop ecx
call fcn.0048a3d2

Function at 0x4aeedc
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jne 0x49f0cc
lea edx, [ebp - 0x14]
mov eax, 0x49c814
call fcn.0048aad6
call fcn.004ba6ae
xchg dword [esp], ebx
pop ebx
push ebp
mov ebp, esp
add esp, 0xffffffec
cmp byte [0x496a2c], 0
jmp 0x4aef00
jmp 0x49d2f3

Function at 0x4b01a8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push 0x4ab164
jmp loc.004a1af3
push 0x4afe6d
jmp 0x497e6d
mov eax, dword [eax]
push eax
jmp 0x4a0c5c
ret
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cpuid
add dword [esi], eax
xor dword [esi], ebx
add dword [esi], ecx
xor dword [esi], edx
jmp 0x49726d
ret
jmp 0x4a6e89
ret
jmp 0x491593
jbe 0x490ad2
jb 0x4ad38d
test esi, ebx
jmp 0x4ae2cd
jmp 0x4a3e29
cpuid
add dword [esi], eax
xor dword [esi], ebx
add dword [esi], ecx
xor dword [esi], edx
mov eax, 0x80000003
jmp 0x4936df
jmp 0x48b032
call fcn.004ba561
cmp dword [ebp - 8], 0
je 0x4a1547
jmp 0x49dc25
jne 0x47e367
jmp 0x4a439d
jmp 0x4a95e4
mov eax, 0x80000004
xor ebx, ebx
xor ecx, ecx
xor edx, edx
cpuid
add dword [esi], eax
xor dword [esi], ebx
add dword [esi], ecx
jmp 0x4a94ee
xor dword [esi], edx
jmp 0x49f46c
jmp 0x4a8de6
or esi, ecx
xor esi, eax
jmp loc.0047e361
pop edx
mov eax, dword [esp]
push edx
call fcn.0049eede
jmp 0x494349
jge 0x49cb54
mov eax, 0x80000002
xor ebx, ebx
xor ecx, ecx
xor edx, edx
jmp 0x49f054
and ecx, ebx
pop edx
jmp 0x49d1e9
call fcn.004aabe6
jmp 0x4af003

Function at 0x4b0f59
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jne 0x4b55d7
jmp 0x4b547d
xchg dword [esp], esi
pop esi
xchg dword [esp], esi
push 0x9eab2861
pop eax
rol eax, 0xc
add eax, 0x5da4a349
and eax, 0xd643856
jmp 0x4adc4f
lea eax, [fcn.004a5b14]
mov byte [eax], 0xc3
jmp fcn.004a5b14
xor eax, 0xdc8526fc
add eax, 0x23a636fd
xchg dword [esp], eax
jmp 0x4bcbb4
jmp fcn.0049970d

Function at 0x4b1141
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
add eax, 0x18
call fcn.0049d1c9
call fcn.0049e8fd
sbb esi, 0x3f22df11
and edx, 0x9fdc301b
jmp 0x4b2af6
not ecx
call fcn.0049d014
push 0x5d7bbeaf
pop edx
xor edx, 0x456812ac
jmp 0x4a654c

Function at 0x4b1d98
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edx
pop edx
cmp byte [eax], 0xf1
jne 0x4aec40
jmp 0x4b3b87
je fcn.004aec3b
jmp loc.0047a05f

Function at 0x4b3a19
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jmp 0x4b0194
call fcn.004b01a8
pop eax
cmp dword [eax], 0
jne 0x494917
jmp fcn.004b3cd7
xchg dword [esp], edx
pop edx
push eax
push 0
jmp 0x48a7fd