joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f880
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push str.Data
push 0
push str.SoftwareITE144
push 0x80000002
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44fa78
push ebx
push ebp
push edi
push 0x800
call fcn.00401ae0
mov cl, byte [esi + 0x98]
mov dword [esp + 0x28], eax
lea edx, [eax + 2]
mov ax, word [esi + 0x84]
shl ax, 6
or ax, word [esi + 0xa0]
and ecx, 3
add edx, 2
add esp, 4
shl eax, 2
or eax, ecx
xor ecx, ecx
mov word [edx - 2], ax
xor eax, eax
mov al, byte [esi + 0x88]
add edx, 2
mov ah, byte [esi + 0x8c]
mov ebp, 0xa
mov word [edx - 2], ax
mov cl, byte [esi + 0xe8]
mov ch, byte [esi + 0xe0]
mov dword [esp + 0x1c], 9
mov word [edx], cx
add edx, 2
mov word [edx], 9
add edx, 2
add esi, 0x124
mov dword [esp + 0x10], esi
jmp 0x44f948
mov esi, dword [esp + 0x10]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add edx, 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, 2
mov word [edx - 2], cx
test cx, cx
je 0x44f984
mov eax, ecx
mov edi, edx
and eax, 0xffff
mov ecx, eax
add edx, eax
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
mov ax, word [esi + 0xc8]
lea ebx, [esi + 0x28]
mov word [edx], ax
add edx, 2
mov dword [esp + 0x18], 6
mov word [edx], 6
add edx, 2
add ebp, 4
mov cx, word [ebx - 8]
mov edi, ebx
mov word [edx], cx
mov ax, word [ebx - 4]
add edx, 2
or ecx, 0xffffffff
add ebp, 6
mov word [edx], ax
xor eax, eax
add edx, 2
mov dword [esp + 0x20], ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov word [edx], cx
add edx, 2
test cx, cx
je 0x44f9fc
mov eax, ecx
mov esi, ebx
and eax, 0xffff
mov edi, edx
mov ecx, eax
add edx, eax
mov ebp, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x20]
and ecx, 3
add ebp, eax
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
add ebx, 0x1c
dec eax
mov dword [esp + 0x18], eax
jne 0x44f9a7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
add ecx, 0xcc
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], eax
jne 0x44f944
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ebp
push esi
mov word [esi], bp
call fcn.0044f810
mov ecx, dword [esp + 0x14]
push ebp
push esi
push 3
push 0
push str.Settings
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call fcn.00401af0
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x20
ret
xor al, al
pop esi
add esp, 0x20
ret
Function at 0x4523b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x466588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x1c], str.Playmode
mov eax, dword [esi + 0x114]
mov dword [esp + 0x20], str.Players
cmp eax, 2
mov dword [esp + 0x24], str.Options
mov dword [esp + 0x28], str.Hiscore
mov dword [esp + 0x2c], str.Exit
mov dword [esp + 0x30], ebp
je 0x45241c
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
cmp eax, ecx
jne 0x452460
mov eax, dword [str.ddddd]
cmp eax, 0x64
jne 0x452460
mov cl, byte [esi + 0x107]
test cl, cl
jne 0x452460
mov cl, byte [0x47df94]
test cl, cl
je 0x452457
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
mov byte [0x47df94], 1
jmp 0x452473
mov byte [esi + 0x107], 0
mov eax, dword [str.ddddd]
mov byte [0x47df94], 0
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x40]
push ebx
cmp ecx, edx
mov ecx, dword [0x47df98]
push edi
je 0x45249b
cmp ecx, ebp
jne 0x45249f
mov ecx, 0xffffffec
mov eax, 0x64
mov dword [0x47df98], ecx
jmp 0x45249f
cmp ecx, ebp
je 0x4524fc
add eax, ecx
cmp eax, ebp
mov dword [str.ddddd], eax
jg 0x4524bf
mov dword [0x47df98], 0x14
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x40], ecx
mov eax, dword [str.ddddd]
cmp eax, 0x64
jl 0x4524e3
mov dword [str.ddddd], 0x64
mov dword [0x47df98], ebp
mov dword [esi + 0xa8], 0x16
mov eax, dword [str.ddddd]
mov ecx, dword [esi + 0x980]
mov edx, eax
sar edx, 1
mov edi, dword [ecx]
push ebp
push edx
push edx
sar eax, 2
push eax
call dword [edi + 0x18]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x97c]
push 3
push ebp
mov dword [esp + 0x1c], edx
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi + 0x980]
push 3
push ebp
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, str.Playmode
mov ebx, 0xd2
test eax, eax
je 0x4525b4
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], ecx
jmp 0x45253a
xor ebp, ebp
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
jne 0x452557
cmp dword [esi + 0x110], 2
jne 0x452557
mov edi, dword [esi + 0x980]
jmp 0x45255d
mov edi, dword [esi + 0x97c]
mov ecx, dword [esi + 0x994]
push eax
lea eax, [esp + 0x20]
push eax
call sub.CoreW32DLL.dll_public:_class_CStr___thiscall_CConfig::GetValue_char_const__
mov dword [esp + 0x44], ebp
mov ebp, dword [edi]
push 0
mov ecx, eax
call sub.CoreW32DLL.dll_public:_char_const____thiscall_CStr::operator_char_const__void_const
push eax
push ebx
push 0x14
mov ecx, edi
call dword [ebp]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0xffffffff
call sub.CoreW32DLL.dll_public_virtual:_void___thiscall_CStr::destructor_void_
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
add eax, 4
add ebx, 0x2a
mov dword [esp + 0x18], eax
inc edi
mov eax, dword [eax]
mov dword [esp + 0x10], edi
test eax, eax
jne 0x452538
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
pop esi
mov al, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x461368
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4794d8
cmp edx, dword [eax]
je 0x46138a
add eax, 8
inc ecx
cmp eax, 0x479568
jl 0x46137b
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4794d8]
jne 0x4614b8
mov eax, dword [0x47e4e8]
cmp eax, 1
je 0x461492
test eax, eax
jne 0x4613bb
cmp dword [0x478e0c], 1
je 0x461492
cmp edx, 0xfc
je 0x4614b8
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4613f2
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00461f90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0045c5c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x461435
lea eax, [ebp - 0x1a4]
push eax
call fcn.0045c5c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46857c
push edi
call fcn.004630e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00461f90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00461fa0
lea eax, [ebp - 0xa0]
push 0x46855c
push eax
call fcn.00461fa0
push dword [esi + 0x4794dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00461fa0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00463050
add esp, 0x2c
pop edi
jmp 0x4614b8
lea eax, [ebp + 8]
lea esi, [esi + 0x4794dc]
push 0
push eax
push dword [esi]
call fcn.0045c5c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408e84
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x42a403f2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5ec00268
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40c2c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c2fd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404748
jmp 0x40c306
mov eax, ebx
mov edx, esi
call fcn.004046ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c310
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40c331
mov al, byte [esp]
jmp 0x40c333
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c9b8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40c830
mov eax, dword [0x54d938]
cmp byte [eax], 0
je 0x40ca25
mov eax, dword [0x54d598]
call fcn.00402f5c
call fcn.004028e8
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040987c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ca6c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40ca5b
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x54d514]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x54e718]
call fcn.0040615c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40d8a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d908
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004048c0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004092d4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d90f
lea eax, [ebp - 0xc]
call fcn.00404658
ret

Function at 0x41cc18
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.004d82d1
call fcn.00445b96
mov ecx, 0x7bc43677
add ebx, dword [0x5498ec]
xchg ebx, eax
or dword [0x54dc53], edi
add esi, 0x94a3ac8e
and eax, dword [0x54ab2d]
mov eax, ecx
add edi, 0x73d78471
dec edx
call fcn.0042a21a
sub dword [0x54dd59], edx
dec ecx
jne 0x41cc27
neg esi
mov ebx, edi
shl eax, 0x1f
mov ecx, 0x5dd03a17
shr eax, 3
neg ebx
not eax
sub eax, dword [0x549394]
call fcn.0051505e
mov eax, 0x44e429b1
or edi, ebx
xor esi, ebx
add edx, 0x58f9938c
sub dword [0x54dcb8], ebx
neg esi
and ebx, eax
shr edx, 0xd
dec ecx
jne 0x41cc65
not edi
cmp ecx, 0x8b18b486
invalid
Function at 0x41ccb4
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, 0x79a1f17b
mov edi, 0x47a626d7
dec ebx
xchg eax, edx
inc ebx
not esi
ror ebx, 0xb
dec esi
not esi
add edi, esi
ror ebx, 0xa
neg esi
dec edx
xor dword [0x54dc31], ecx
or ebx, dword [0x54df6e]
xchg ebx, edx
call fcn.004e0514
call fcn.004baecd
xchg ebx, edx
add dword [0x54dd20], ebx
inc edx
neg esi
rol ebx, 0xa
sub edi, esi
not esi
inc esi
rol ebx, 0xb
not esi
dec ebx

Function at 0x41cd04
Capabilities:
Hash data using murmur3

Disassembly:
xchg eax, edx
inc ebx
sub edi, 0xcd102ce1
add dword [0x54dc58], ebx
sub edi, 0xa78f81b5
or dword [0x54dc41], eax
rol ecx, 0x10
neg esi
xor esi, ecx
xor dword [0x54dc4d], eax
call fcn.0042e6c6
dec ebx
sub dword [0x54dc43], ecx
xor esi, dword [0x54de11]
sub ecx, 0x480d879c
dec eax
or ebx, dword [0x54df0e]
call fcn.004c2072
inc eax
add ecx, 0x480d879c
or dword [0x54dc30], edx
inc ebx
call fcn.00501cb4
or dword [0x54dddd], esi
xor esi, ecx
neg esi
ror ecx, 0x10
sub dword [0x54dc12], esi
add edi, 0xa78f81b5
add dword [0x54dcc8], ecx
add edi, 0x856a060a
and dword [0x54dd38], 0xd708bdb4
rol eax, 0x1c
inc edi
dec ecx
xor dword [0x54dd86], eax
xchg eax, esi
xor esi, dword [0x54deea]
add dword [0x54dd5a], 0xa5f9bcfe
inc ecx
mov dword [0x54dd22], edx
or dword [0x54dc9c], ecx
dec ecx
xor dword [0x54dc1d], 0xf404f27e
xchg eax, esi
and dword [0x54dc04], edx
inc ecx
dec edi
ror eax, 0x1c
xor dword [0x54dd29], 0xc1db86a8
push edi
sub ecx, dword [0x54df72]
not edi
xchg esi, eax
or esi, dword [0x54de03]
sub ecx, dword [0x54deea]
add edx, ebx
sub esi, ebp
sub esi, dword [0x54df94]
inc esi
neg eax
rol esi, 3
xchg ecx, edx
invalid

Function at 0x41ce34
Capabilities:
Hash data using murmur3

Disassembly:
fst qword [eax + eax + 0x39]
or eax, 0xf38123c3
int3

Function at 0x41ced8
Capabilities:
Hash data using murmur3

Disassembly:
mov cl, 0x5c
or byte [eax], al
neg eax
dec edi
call fcn.00476a80
sub esi, esp
xchg edi, eax
sub dword [0x54dd87], edi
or ebx, dword [0x54df2a]
mov dword [0x54dd29], edi
xchg edi, eax
add esi, esp
call fcn.004e13e7
inc edi
neg eax
call fcn.004584c5
neg edx
inc ebx
inc esi
sub edi, 0x3293548c
sub dword [0x54dd23], 0x79b13295
call fcn.004a8a8a
xor edi, 0x49e1f8d6
or edx, dword [0x54df12]
not esi
xor edi, 0xf84b1aff
call fcn.0049043f
not esi
or esi, dword [0x54df35]
rol edx, 0x17
call fcn.0044c03e
ror edx, 0x17
not esi
call fcn.00431006
xor edi, 0xf84b1aff
not esi
xor edi, 0x49e1f8d6
call fcn.004b873a
push edi
xor ecx, 0x7d057787
dec esi
and dword [0x54dcff], ebx
not ebx
or edx, dword [0x54de51]
ror edi, 0x16
sub esi, dword [0x54dec0]
call fcn.004c714a
xor dword [0x54dc44], 0x48b9da26
xor edx, dword [0x54deb2]
or dword [0x54dd6a], ecx
add dword [0x54dd8f], edx
sub ecx, esp
add ecx, esp
and dword [0x54ddb5], edx
xor dword [0x54dd98], edx
invalid
invalid
Function at 0x41cfc4
Capabilities:
Hash data using murmur3

Disassembly:
rol edi, 0x16
not ebx
and dword [0x54dd97], eax
inc esi
xor ecx, 0x7d057787
mov eax, 0xdff4594c
sub eax, dword [0x54dfb9]
xor esi, 0x61ab720c
add edx, 0x1c07341b
and dword [0x54dcf0], edx
xor ecx, dword [0x54de0c]
call fcn.004bbd5e
neg esi
dec esi
xor ecx, esi
dec ebx
call fcn.004ff749
sub edx, edi
neg edi
rol eax, 0xb
call fcn.00408c7f
xor edx, 0x35149c30
inc eax
xor ecx, 0x8e3b6d0
not esi
add dword [0x54dcd7], ebx
add dword [0x54dc57], esi
not esi
xor ecx, 0x8e3b6d0
dec eax
xor edx, 0x35149c30
call fcn.0045404a
ror eax, 0xb
neg edi
add edx, edi
call fcn.004b8bf1
inc ebx
xor ecx, esi
inc esi
neg esi
add dword [0x54dd44], esi
sub edx, 0x1c07341b
xor esi, 0x61ab720c
xor eax, 0xc7238f72
rol ecx, 0x19
call fcn.004fa27b
sub dword [0x54dc00], ecx
or eax, dword [0x54df5d]
call fcn.00418a6e
and dword [0x54dcaf], eax
call fcn.0044c11b
or dword [0x54dcaa], edx
add edx, 0xd001b860
xor dword [0x54dd1e], ecx
call fcn.004e2888
not esi
mov dword [0x54dcdd], ebx
neg eax
inc eax
xchg ebx, esi
call fcn.0044abf9
xchg eax, esi
neg eax
sub dword [0x54dcaf], edx
sub ecx, ebp
call fcn.0041073d
add ecx, ebp
mov dword [0x54dd2f], edi
neg eax
xchg eax, esi
xchg ebx, esi
dec eax
neg eax
not esi
call fcn.0040e1d4
sub dword [0x54dcbe], edx
sub edx, 0xd001b860
or dword [0x54dd53], ecx
call fcn.0045b359
xor dword [0x54dc7a], ebx
call fcn.004db2f6
sub dword [0x54dc45], esi
call fcn.00515457
ror ecx, 0x19
add eax, 0x559a8f2d
rol edx, 0x19
inc ecx
dec esi
add ecx, 0x6ab8bc13
xor dword [0x54dcd3], eax
neg ecx
and dword [0x54dc5b], esi
not esi
xchg edi, esi
ror eax, 5
call fcn.004a4d5c
rol eax, 5
xchg edi, esi
not esi
sub dword [0x54ddd6], edi
neg ecx
or dword [0x54dc46], eax
sub ecx, 0x6ab8bc13
inc esi
dec ecx
ror edx, 0x19
push eax
xchg ebx, esi
xor ecx, ebx
or dword [0x54dd73], edi
call fcn.0051bdab
neg esi
mov dword [0x54ddad], edi
xor ebx, esi
neg ebx
call fcn.00445ec6
sub dword [0x54dcdc], eax
xor edx, 0x13ac8a8b
call fcn.0047c9ec
inc edi
inc edx
xchg eax, esi
or dword [0x54dc35], esi
xor ecx, ebx
inc edx
call fcn.004fe5c6
call fcn.0043c552
dec edx
xor ecx, ebx
add dword [0x54dc0f], edi
xchg eax, esi
dec edx
dec edi
call fcn.00483ed3
xor edx, 0x13ac8a8b
call fcn.004c06b1
neg ebx
xor ebx, esi
mov dword [0x54dd09], ecx
neg esi
xor ecx, ebx
xchg ebx, esi
push esp
sub dword [0x54dccf], edx
add eax, esi
xor esi, 0xda51cb01
dec edi
add edx, ebp
xor dword [0x54dcb4], 0x32778402
inc edx
xor eax, dword [0x54de7a]
inc edx
add edx, dword [0x54df6e]
rol eax, 4
call fcn.0051fbd3
call fcn.004f9c74
call fcn.00488d5a
call fcn.00482a16
ror eax, 4
dec edx
dec edx
and dword [0x54dd1f], 0x91601c47
sub edx, ebp
inc edi
xor esi, 0xda51cb01
sub eax, esi

Function at 0x41d230
Capabilities:
Hash data using murmur3

Disassembly:
call dword [sym.imp.kernel32.dll_LoadLibraryA]
xor eax, dword [0x54debb]
sub edi, 0x3d4b27d7
call fcn.0049fe31
mov dword [0x54dc14], ecx
xor ecx, 0x6080f04a
ror edx, 0x1f
neg edi
inc esi
or esi, dword [0x54de16]
add dword [0x54dc26], ebx
invalid
ja 0x41d1fc
Function at 0x41d2bc
Capabilities:
Hash data using murmur3

Disassembly:
fst qword [eax + eax - 0x62]
mov dword [eax + 0x3d18e8c8], edi
add eax, 0x1d0b4b00
ret 0x54de

Function at 0x41d2d4
Capabilities:
Hash data using murmur3

Disassembly:
sub eax, 0x7fc0d74c
not esi
add edx, dword [0x54de1c]
inc ecx
neg edi
xor eax, 0xd348e62b
not esi
add edx, eax
sub ebx, 0x7d2ff204
call fcn.004f889c
call fcn.0046257f
add ebx, 0x7d2ff204
sub edx, eax
not esi
xor eax, 0xd348e62b
neg edi
dec ecx
not esi
add eax, 0x7fc0d74c
call fcn.004a8aff
inc ebx
call fcn.00487ed2
and dword [0x54dda1], 0xaeba8cf9
sub esi, 0x97936806
mov esi, 0x27237204
sub dword [0x54dd47], ebx
add edi, 0x3e1159c0
rol eax, 7
xor dword [0x54dc28], ecx
add edi, edx
mov dword [0x54dcd6], eax
add edx, dword [0x54df6d]
xor esi, ebp
or eax, dword [0x54dfaa]
dec edx
and dword [0x54dd10], ecx
add ecx, esi
xor esi, 0xf03c3d11
sub ecx, edi
neg edx
or edi, dword [0x54deb9]
inc ecx
call fcn.00405699
or dword [0x54dc5e], 0x9fc9bd9a
and dword [0x54dcf1], 0x5f3d1c83
and dword [0x54ddd1], 0x41462886
dec ecx
neg edx
add ecx, edi
xor esi, 0xf03c3d11
sub ecx, esi
sub dword [0x54ddb2], eax
inc edx
xor esi, ebp
sub edi, edx
ror eax, 7
sub edi, 0x3e1159c0
sub dword [0x54dd3e], edi
add esi, 0x3c9a62a5
or dword [0x54dcce], 0x242bd03c
invalid
invalid
sti

Function at 0x41d578
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx], cl
adc eax, 0x54dcfb
push esp
add byte [edi - 0x7f], cl
loope 0x41d546
push ebx
and al, 0xec

Function at 0x41d8fc
Capabilities:
Hash data using murmur3

Disassembly:
fcom qword [eax + eax - 9]
rol dword [ebx], cl
enter 0x1509, 0x23
fst qword [eax + eax + 3]
salc
call fcn.0043b8c6
xor eax, ecx
neg eax
call fcn.00456074
neg edi
sub esi, edi
sub esi, 0xb108cc3e
ror eax, 8
xchg ebx, esi
inc ebx
xor eax, esi
inc ecx

Function at 0x41d92c
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [0x54dc4f], edi
xchg esi, eax
not ecx
ror ebx, 8
neg esi
ror ecx, 0xf
dec ebx
and dword [0x54dd5b], eax
xor ebx, dword [0x54df0f]
neg esi
mov dword [0x54dd24], edi
xor dword [0x54dccf], ebx
call fcn.004fb0ad
sub dword [0x54dcfb], ecx
Function at 0x41d964
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.005196ca
call fcn.004f520b
call fcn.00524542
sub dword [0x54dcc5], esi
sub dword [0x54dd8b], edi
neg esi
xor dword [0x54dc7f], esi
inc ebx
rol ecx, 0xf
neg esi
rol ebx, 8
not ecx
xchg esi, eax
dec ecx
xor eax, esi
dec ebx
xchg ebx, esi
rol eax, 8
sub esi, 0x887209ff
dec edx
sub ecx, dword [0x54df8b]
xor ebx, dword [0x54de45]
inc ebp
ficom word [eax + eax - 0x18]
cmp al, 0x1d
or al, 0
sub ecx, ebx
xor edx, eax
rol eax, 7
or edx, dword [0x54df31]
xor ebx, 0x2af099e8
mov dword [0x54dc8e], eax
add ebx, 0x9fe7fee5
xor esi, ecx
and dword [0x54dd1d], eax
xchg ebx, esi
xchg ebx, esi
sub dword [0x54dc64], ebx
xor esi, ecx
sub ebx, 0x9fe7fee5
xor ebx, 0x2af099e8
ror eax, 7
xor edx, eax
add ecx, ebx
call fcn.004c5d24
inc edx
push esi
not ecx
dec esi
xor esi, 0x30e4aa29
xor edx, dword [0x54def4]
sub edx, eax
rol ecx, 0x13
and dword [0x54dc9f], esi
call fcn.00451e3f
xor esi, 0xa80402c8
xor ecx, 0xf8a1fe2b
sub ecx, eax
inc edx
not esi
inc edx
xor ecx, 0x4d573e81
or dword [0x54dc78], esi
xchg edx, esi
xor edx, dword [0x54ded1]
or edi, dword [0x54df2b]
sub esi, dword [0x54de9b]
and dword [0x54dd4d], 0x454dc2fa
or dword [0x54ddbb], 0x27fa53e8
xchg edx, esi
xor ecx, 0x4d573e81
dec edx
not esi
dec edx
add ecx, eax
xor ecx, 0xf8a1fe2b
xor esi, 0xa80402c8
call fcn.0046440a
ror ecx, 0x13
add edx, eax
xor esi, 0x30e4aa29
inc esi
not ecx
push esp
dec edx
not edx
mov dword [0x54dc6f], ebx
xor dword [0x54dd23], ebx
sub esi, dword [0x54dfa0]
call fcn.0051efe2
sub dword [0x54dd57], edi
xor edx, edi
sub dword [0x54dc9e], ebx
xchg ecx, esi
xor edi, dword [0x54df1f]
dec ebx
add eax, dword [0x54df4e]
add eax, 0xc8262c72
xor dword [0x54dce0], eax
ror ebx, 3
invalid

Function at 0x41d9ac
Capabilities:
Hash data using murmur3

Disassembly:
inc ebp
ficom word [eax + eax - 0x18]
cmp al, 0x1d
or al, 0

Function at 0x41db6c
Capabilities:
Hash data using murmur3

Disassembly:
add dword [0x54dc56], esi
ror esi, 0x15
call fcn.004f1633
sub edi, 0x9b279766
rol edi, 0x19
call dword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, 0xf1ace6e9
add eax, edx
or ecx, dword [0x54de6f]
add dword [0x54ddbd], ebx
add ecx, edi
sub ecx, dword [0x54dfb1]
xor edi, edx
add ecx, eax
add edx, dword [0x54de81]
mov dword [0x54dc06], esi
dec ebx
xor ecx, dword [0x54dfb2]
sub esi, dword [0x54de84]
rol ecx, 5
xor ecx, 0x1c5d3ff0
neg esi
or ebx, dword [0x54dea6]
xchg ebx, esi
xchg ebx, esi
neg esi
xor ecx, 0x1c5d3ff0
ror ecx, 5
inc ebx
mov dword [0x54dddc], ecx
sub ecx, eax
xor edi, edx
sub ecx, edi
sub dword [0x54dc5a], eax
sub eax, edx
xor edx, 0xf1ace6e9
add esp, 0x10
neg esi
ror eax, 0x19
add edi, dword [0x54de84]
inc edx
add edx, dword [0x54de73]
sub dword [0x54dce7], ecx
xor edi, ebx
not eax
sub edx, dword [0x54ded1]
xor ebx, 0x139b625d

Function at 0x41dd20
Capabilities:
Hash data using murmur3

Disassembly:
push esp
add byte [ecx + 0x54dd0e0d], cl
add byte [ecx + 0x8142f1], al
sub byte [edi - 0x18], cl
cdq
mov ebx, 0x35210002
xchg edi, eax
fst qword [eax + eax + 0x4f]