joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a70
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x41b604]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x414a83
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x414ac4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x41b6ac]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x414af6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x414afa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x414aeb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x414b18
mov bl, byte [esp + ecx + 0x4c]
jmp 0x414b1c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x414b0d
xor ecx, ecx
mov eax, 0x41b614
xor ebx, ebx
mov bl, byte [ecx + 0x41b6bc]
cmp byte [esp + ebx + 0x14], 0
je 0x414b47
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x41b6d4]
cmp byte [esp + ebx + 0x14], 0
je 0x414b5e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x414b2e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x414ab7
lea edx, [esp + 0x84]
push edx
call fcn.00414ba0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x42e21c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
je 0x42f847
pop edx
mov eax, dword [esp]
jmp 0x431d78
pop edx
mov eax, dword [esp]
push edx
call fcn.00443782
jmp 0x43a6cc
jmp fcn.0042e21c
jmp 0x43ed55
mov eax, 0xbeb860a6
call fcn.00442c6c
push esi
push 0x40662f33
pop esi
jmp 0x440845
call fcn.0043c729
call fcn.0043ab33
jp 0x43edc7
cmp esi, dword [edi + eax*2]
add al, 0
jmp 0x619854
jmp 0x446bb7
lea eax, [fcn.0042e21c]
mov byte [eax], 0xc3
jmp 0x42fc57
sub esi, 0xb8625ff5
add esi, 0x783da186
mov dword [esi], eax
pop esi
jmp 0x444c5c

Function at 0x42e3a5
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], eax
pop eax
mov esi, dword [esi]
call fcn.00448361
jmp 0x436a1a
ret
ret
js 0x439fd3
rol ecx, 0x18
cmp ecx, 0x56ef5802
jmp 0x435816
jae 0x4498f5
test byte [ebp - 7], 8
je 0x4428a8
push ebp
push 0x437850
jmp 0x4436cd
jl 0x44a31b
jmp 0x434f51
je 0x4428a8
push ebp
mov eax, dword [ebp - 0x20]
push 0x43f061
jmp 0x42f601
jne 0x434275
xor ecx, ebp
jmp 0x447248
jmp 0x4324fa
ret
push 0x449d7c
jmp 0x43f876
jmp 0x4424ab
cmp edx, 0x21459f4a
jmp 0x43426f
jmp fcn.0042f05b
test byte [ebp - 7], 8
jmp 0x4367de
add ecx, 0x2184e36e
xchg dword [esp], ecx
jmp 0x447fb3

Function at 0x42f05b
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x43a1f6
pop edx
push 0x43220a
jmp 0x44a34a
xchg edx, ebx
jb 0x449097
push edx
xchg edx, ebx
jmp 0x433cdd
pop eax
shr bl, 1
rcl bh, 7
ror bx, 1
push eax
jmp 0x438be9
jne 0x443e64
jmp 0x439899
jmp 0x449086
jne 0x4396fb
call fcn.00437456
jmp 0x440d08
push 0x43cfea
jmp 0x43de13
jmp 0x42ebda
push 0x28714035
pop eax
xor eax, 0x299b9faf
push edx
push 0x2612e3f2
pop edx
add edx, 0xd9ed1c11
and bl, dl
jmp 0x438802
jmp 0x442946
sbb ecx, esi
js 0x43d931
jmp fcn.0043fc66
jmp 0x4409ce
ret
je 0x42e35f
jmp 0x430793
jne 0x42f527
not ebp
jmp 0x443e64
call fcn.00440de4
jmp 0x4350b2
jne 0x4396fb
push ecx
push 0xa519d344
jmp 0x43dff9
push edx
xchg edx, ebx
jmp 0x43418e
ret

Function at 0x42f9e0
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], esi
pop esi
call dword [ebp - 4]
test eax, eax
je 0x43ebc4
jmp 0x432e71
jne 0x44ae45
jmp 0x447593
or ebp, 0xa2ab8e37
xchg ebx, eax
mov edx, 0xc127c648
jmp 0x44ae45
mov eax, dword [ebp - 0xc]
call fcn.004434ce

Function at 0x4302b3
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cmp ebp, eax
jmp 0x438653
mov dword [esp], esi
pushfd
push 0xb787f222
pop esi
sub esi, 0x2338f5ac
js 0x448d48
jmp 0x44880f
jg 0x448746
cdq
test edx, ebx
jmp 0x44605b
pop edx
jne 0x43a2f5
jmp 0x446ae5
jno 0x44284e
jmp 0x446ed6
je 0x43e942
jmp 0x43613b
jmp fcn.0043fdf7
jmp 0x42faa2
ret
add esi, 0x6bf3ece8
call fcn.00436f1d
je 0x446ed6
jmp 0x44727c

Function at 0x430484
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], ebx
pop ebx
push ecx
push 0xf46f09bf
pop ecx
jmp 0x4433ae
or ecx, 0x186f920f
add ecx, 0x3d4870c
xchg dword [esp], ecx
jmp fcn.0042f05b

Function at 0x43095a
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], edx
pop edx
mov byte [eax], 0xc3
jmp 0x43fcd8
jmp fcn.00434d26
Function at 0x4309f9
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], esi
pop esi
mov edx, 0xcb39536b
call fcn.004368be
push esi
push 0x3dc21779
jmp 0x4399f9
jmp 0x43f972
jne 0x43890b
jmp 0x43546f
xchg dword [esp], ebx
mov esi, ebx
pop ebx
add esi, 0x3435b984
xor esi, 0x8f60b2b6
jmp 0x443c76
add esi, ebp
add esi, 0x1689db1
mov dword [esi], eax
pop esi
jmp 0x4461c1
cmp dword [ebp - 4], 0
je 0x4339da
jmp 0x43c968

Function at 0x433214
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], ecx
pop ecx
sub al, 0x99
push 0x30362dbb
pop edx
or edx, 0xee28f783
jmp 0x436dfd
add edx, 0xdb8b2b10
add edx, ebp
add edx, 0x2635d531
mov edx, dword [edx]
imul byte [edx]
cmp al, 0xa4
je 0x446ed6
jmp 0x433938

Function at 0x4332ef
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov ecx, ebx
jmp 0x438961
jmp 0x43a738
mov dword [esp], edi
pop edi
cmp byte [eax], 0x73
je 0x432c03
jmp 0x43f556
cdq
sub ebx, ebp
pop edx
push 0x7e858182
pop eax
rol eax, 0x13
or eax, 0x28ae3d3c
add eax, 0xc3cc517a
jmp 0x4308fc
jmp 0x42e602
jne 0x438965
jmp 0x439cc7

Function at 0x434d26
Capabilities:
Hash data using murmur3

Disassembly:
add eax, 0xdcdbd6
popfd
xchg dword [esp], eax
jmp fcn.0043f4b7
jmp 0x43c267
jmp 0x43642d
cmp eax, 0xb11f6c5b
jmp 0x440625
push 0x7dd1ded8
pop edx
and edx, 0x503f0792
add edx, 0xb0306a04
mov dword [edx], eax
pop edx
jmp 0x443f14
pop edx
jo 0x43c2aa
mov eax, dword [esp]
push edx
push esi
push 0x809deba2
pop esi
jmp 0x42ec76
xor ecx, 0x1a480422
and bl, cl
pop ecx
push eax
pushfd
jmp 0x445566
rol eax, 0x10
xor eax, 0x83a6b595
call fcn.00442c6c
push edx
jmp 0x434999
pop ecx
rol ecx, 0xd
and ecx, 0x9eca0c69
jmp 0x43305c
jge 0x42e2c5
jmp 0x447099
jmp fcn.00443782
sub esi, 0x12527c84
add esi, 0x91f8536e
xchg dword [esp], esi
jmp 0x43b18c
mov eax, dword [esp]
jmp 0x44891e
lea eax, [fcn.00434d26]
call fcn.0043095a
jmp 0x437460
jmp 0x437e1a
jmp 0x43dfee
jmp 0x434171
jmp 0x4487c8
ret
push edx
call fcn.00443782
push 0xe185d38
pop eax
jmp 0x4364c6
push 0xcc479c96
pop eax
and eax, 0xe9ba3fd3
or eax, 0xff669ff7
jmp 0x4450d5
jmp 0x447698

Function at 0x434e96
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], edx
pop edx
add edi, 0xdec67138
xchg dword [esp], edi
jmp 0x436f00
jmp fcn.0042f05b

Function at 0x435ad6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.004485de
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jne 0x446edb
jmp 0x4348d4
jmp 0x448d53
jns 0x44039b
jno 0x447f26
jmp 0x440392
pushfd
xchg dword [esp], edi
jmp 0x449ae9
jno 0x447f26
pushfd
xchg dword [esp], edi
push 0x447501
jmp 0x44041e
pushfd
jmp 0x433933

Function at 0x435ef8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov dword [esp], ebx
push 0x89d65cd5
pop ebx
or ebx, 0x74eb2eee
Function at 0x4364ab
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push 0x445c11f6
pop ebx
and ebx, 0xff118103
or ebx, dword [0x400110]
jmp 0x448c8a
jmp 0x440983
jge 0x43959e
xor eax, 0x889c0df
mov dword [esp], ebx
pop ebx
xor eax, eax
jmp 0x42f3c7
jne 0x433cd5
jmp 0x430663
xor ebx, 0x84d9e590
add ebx, ebp
add ebx, 0xc732de9
mov dword [ebx], eax
pop ebx
jmp 0x440f09
cmp dword [ebp - 4], 0
je 0x44707f
jmp 0x442f98
cmp ebx, esi
jmp 0x434122
jmp 0x43f62b
jmp 0x43b5b9
jmp 0x43e45d

Function at 0x436f88
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jmp 0x430536
je 0x438c24
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jne 0x438c29
jmp 0x441183
xchg dword [esp], edi
pop edi
xor edi, 0x8b3d1a01
add edx, edi
pop edi
mov edx, dword [edx]
imul byte [edx]
cmp al, 0xa4
jmp 0x42fad2
and esi, 0xff918f8e
add edx, 0xac1193db
push 0x961ec938
jmp 0x438c1e
je 0x438c24
jmp 0x43fa98

Function at 0x437456
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], eax
pop eax
push ecx
push 0xa519d344

Function at 0x43780b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jne 0x43a5b2
jmp 0x42f27c
jmp 0x43a9e5
pop eax
or eax, 0x3c42b9a1
call fcn.0044384c
jmp 0x448349
push ebp
mov ebp, esp
push ecx
push edi
jmp 0x43ce0e
jmp 0x431d19
push 0x3b81c383
rol esi, 6
sbb ebp, 0x2fa74e20
mov edi, 0x4408a1a0
push 0x2361a18d
mov eax, 0x901f02f6
jmp 0x431603
mov dword [ecx], edi
jmp 0x43a59f
push 0x6c21ae4d
pop edi
or edi, 0xe40b9ba4
sub edi, 0x32fc804d
add edi, 0x28d62a45
jmp 0x44719c
add edi, ebp
add edi, 0x1dfa9617
mov dword [edi], eax
pop edi
mov eax, dword [ebp - 4]
mov al, byte [eax]
js 0x448d87
sub al, 0x99
jmp 0x433f83
jmp 0x445d95
mov edx, dword [ebp - 4]
imul byte [edx]
cmp al, 0xa4
je 0x44480d
jmp 0x42e341
sub al, 0x99
mov edx, dword [ebp - 4]
jmp 0x438a72

Function at 0x4379d5
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], ecx
pop ecx
push 0x9105c9ae
pop eax
sub eax, 0x6f3f2ffe
jmp 0x44102d
add eax, 0xde7d880e
xchg dword [esp], eax
jmp fcn.00437549
Function at 0x438024
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jle 0x43fa66
call fcn.004424e1
mov edx, 0xbe8ce1b7
call fcn.004368be
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jmp 0x449fde
jmp 0x4372e4
je 0x432c03
jmp 0x440daf
popfd
xchg dword [ebp], ecx
test ecx, 0x100dc3a3
jmp 0x432bfd
jmp 0x431dde
sub ebx, 0x7a21d367
and ecx, 0xf1924e40
jmp 0x42f322
jmp 0x43baa9
mov dword [ebx], edi
jmp 0x43e1ba
cmp byte [ebp - 5], 0
jne 0x43ebc4
jmp 0x432f7f
jne fcn.0042f1d4
je 0x42e290
jmp 0x435096
mov byte [ebp - 5], 0
jmp 0x43800e
xchg dword [esi], edi
add edi, ecx
test edx, 0xe6ca5d7d
jmp 0x42e28a
jne 0x43e1c8
jmp 0x431510
jnp 0x43a738
xor esi, ebp
push esi
push 0x49161429
xchg dword [esp], edx
mov esi, edx
pop edx
jmp 0x43ea16
jne 0x44a18e
jmp 0x4497ab
jo 0x432b62
cmp byte [ebp - 5], 0
jne 0x43ebc4
jmp 0x43e161
xchg dword [esp], eax
pop eax
call fcn.004368be
push edi
push 0xfebee323
jmp 0x444d18
jg 0x43ae7c
jmp 0x43e263
je 0x435ff8
jmp 0x43970f
add eax, ebp
add eax, 0xf73b12e
mov eax, dword [eax]
cmp byte [eax], 0x53
jmp 0x4315fe
jne 0x447e63
jmp 0x42eeaf
jmp 0x439881
and esi, ebp
adc esi, 0xdf36bb0d
sbb edi, 0xc81c86be
mov eax, dword [ebp - 4]
call fcn.004327ea
rol ebx, 0x19
adc ebp, ecx
test eax, 0x5d7cdb06
jmp 0x435ff0
mov dword [edi], eax
pop edi
cmp dword [ebp - 4], 0
je 0x4339da
jmp 0x42ec97
add esi, 0xb72d869c
xchg dword [esp], esi
jmp 0x4485d4
xchg dword [esp], esi
mov edx, esi
pop esi
cmp dword [ebp - 8], 0
je 0x440350
cmp dword [ebp - 0xc], 0
jmp 0x449380
jmp 0x431599
pop edi
rol edi, 0x10
or edi, 0xe57c770b
add edi, 0x9dc02bf9
add edi, ebp
add edi, 0x7abfd444
jmp 0x43e7e4
jmp fcn.004424e1
and esi, 0x7442c279
sub ecx, eax
popfd
pushfd
jmp 0x44a18c
xchg edi, ecx
push 0x97518284
pop eax
rol eax, 0x19
call fcn.004401f0
jmp 0x435ba7

Function at 0x438b04
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], esi
pop esi
lea eax, [ebp - 0x20]
jmp 0x44509e
jmp 0x43b709
lea eax, [ebp - 0x20]
push eax
call fcn.0043baeb
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jmp 0x4461b0
mov dword [eax], 0x594c4c4f
lea eax, [ebp - 0x1c]
mov dword [eax], 0x474244
push 0
jmp 0x43a469
je 0x444aa0
jmp 0x432bf3

Function at 0x43b114
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.004409d4
jmp 0x448aa7
call 0x444974

Function at 0x43babc
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x439b27
je 0x43a215
jmp 0x4484bb
xchg dword [esp], ebx
pop ebx
mov eax, dword [eax]
cmp byte [eax], 0x52
jne 0x447e63
jmp 0x439a08

Function at 0x43cda4
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov dword [esp], esi
pop esi
jne 0x4417c2
sub al, 0x99
push 0xc00a614b
pop edx
xor edx, 0xcf857fb7
and edx, 0x4143e146
jmp 0x44560b
call fcn.0043d133
jmp 0x449834
xor edx, 0xeb419116
add edx, ebp
add edx, 0x15bd6eaa
mov edx, dword [edx]
imul byte [edx]
jmp 0x445d62
Function at 0x43d1ed
Capabilities:
Hash data using murmur3

Disassembly:
jae 0x441075
jbe 0x43c4b4
cmp edi, ebp
jmp 0x4364e0
xchg dword [esp], edi
ret
jmp 0x4345b6
jo 0x43d089
and edx, 0x60d16e48
jmp 0x44863a
add eax, edx
jmp 0x43f86e
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x43ff77
call fcn.00448f36
test al, al
je 0x448eff
jmp 0x43d692
xchg dword [esp], eax
pop eax
call fcn.00448f36
test al, al
je 0x43c75c
jmp 0x4427b8
jne 0x44863a
jmp 0x431fe8
pushfd
cdq
call fcn.0043f880
ret
cmp dword [ebp - 4], 0
je 0x4439b6
call fcn.0042e67e
jmp fcn.0043ee0e
jne 0x43f870
jmp 0x4384ff
call fcn.00448652
ret
push edi
push 0xae9c7712
mov edi, 0x4345bf
jmp 0x434c0d

Function at 0x4400a7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xor dword [esp], 0x2ffa30c2
call fcn.004440ab
pushfd
mov dword [esp], eax
call dword [ebp - 4]
jmp 0x43d924
cmp dword [ebp - 4], 0
je 0x44318c
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push 0x2ffa30c5
jmp 0x435b55
call fcn.004368be
mov dword [ebp - 4], eax
jmp 0x44923d
test eax, eax
jl 0x44318c
jmp 0x44024e
jmp 0x43ca94
xchg dword [esp], edx
pop edx
call fcn.0043a32f
mov edx, 0x3bd2ec5c
jmp 0x43d9b1
jge 0x443184
jmp 0x44b0d9
jmp 0x43ba8d

Function at 0x44095b
Capabilities:
Access peb ldr_data

Disassembly:
jle 0x447ad7
ror ebx, 0x19
sub ecx, ebp
jmp 0x437027
test ebp, 0xc2242be7
jmp 0x4344cf
jg 0x443741
xchg eax, ebx
call fcn.00448652
ret
call fcn.00448f36
jmp 0x446d24
cmp edi, 0xcd648ec6
jmp 0x44805f
jmp 0x438e57
mov byte [eax], 0xc3
jmp fcn.00433af6
jmp 0x43526b
xchg dword [esp], eax
pop eax
call fcn.00448f36
test al, al
je 0x43703a
jmp 0x4499bc
test al, al
je 0x42f583
jmp 0x44a224
jmp 0x4440d0
jae 0x43c24f
mov edi, 0xc079a235
push edx
push 0xae384dac
pop edx
add edx, 0x520aa7d1
xchg dword [esp], edx
jmp fcn.0043f880
jne 0x43702f
jmp 0x43cfd2
jne 0x44806a
jmp 0x43a3e5

Function at 0x445db9
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov eax, ebp
xchg dword [esp], ebp
call fcn.0043fa8a
lea eax, [ebp - 0xc]
push eax
jmp 0x4463ae
mov dword [esp], ecx
pop ecx
xchg dword [esp], edx
mov eax, dword [ebp - 8]
push ebp
xchg eax, ebp
jmp 0x43557d
mov eax, dword [ebp - 8]
push eax
call fcn.0043fc76
cmp dword [ebp - 0xc], 0
je 0x43df0a
jmp 0x441a0a

Function at 0x447259
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
pop ecx
call fcn.00448577
mov dword [esp], ebx
pop ebx
call fcn.00448583
jmp 0x43d9ab
Function at 0x447462
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jmp 0x43009b
jmp 0x42e3b5
je 0x447ede
jmp 0x438ad6
jmp 0x4477b0
push 0x1c0ba991
adc ecx, edx
js 0x447cc6
jmp 0x444ef5
pop esi
mov ebp, 0x43be27
jmp 0x43be1e
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jne 0x44673f
jmp 0x4356b5
add eax, ebp
add eax, 0xc82fcd51
mov eax, dword [eax]
cmp byte [eax], 0xf1
jne 0x438c29
jmp 0x442033
xchg edi, edx
call fcn.00437c22
mov eax, 0xdbe351cf
push ecx
push 0xec52b2fe
pop ecx
and ecx, 0xa6c9b0b5
xor ecx, 0x7c2231c2
jmp 0x436709
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jne 0x43a65a
sub al, 0x99
mov edx, dword [ebp - 4]
imul byte [edx]
cmp al, 0xa4
je fcn.00432a44
jmp 0x436e98
add edx, 0x2851717a
mov edx, dword [edx]
imul byte [edx]
call fcn.0044adfa
jmp 0x445d5d
rol esi, 0xf
mov ebx, eax
shl ebx, 0x17
jne 0x431463
mov eax, dword [esi]
jmp 0x436e1d
jmp 0x4373c4
call fcn.004369db
push 0x65e2b8a7
xor dword [esp], 0x65e2b8a7
jmp 0x43648f
pushfd
xchg ebx, ebp
jmp 0x438c87
jmp 0x441852
lea eax, [ebp - 0x100]
jmp 0x444a34
cmp edi, 0x1dcb4299
jmp 0x44672e
cmp ecx, 0x6c5d5656
jmp 0x445a76
push 0xf752aa7e
pop eax
rol eax, 0xa
add eax, 0xed2636ce
jmp 0x432279
jne 0x432a38
jmp 0x43e8dc
jnp 0x4432d9
xor ebx, 0xcafd9866
jmp 0x44307b
ret
call fcn.00442721
jmp 0x442d6f
push ecx
push 0x432d23
jmp 0x43b7fe
jmp 0x44a80b
jmp 0x433aff
pop ecx
mov ebp, 0x43780a
xchg dword [esp], ebp
jmp 0x4377ff
xchg dword [esp], ebp
mov ecx, ebp
pop ebp
pop ebp
ret
ret
xchg dword [esp], ebp
ret
jbe 0x445dd1
and ebx, 0xa3636228
add ecx, 0x27e1d826
push 0x4479e0
jmp 0x42fec7
mov byte [ebp - 0x4b], 0
push 0x3026e129
pop eax
call fcn.00448e2a
jmp 0x43391e
ja 0x4438b6
or eax, 0x3c163b86
adc edx, ebp
jmp 0x43cd0b
mov dword [edi], ebp
adc ebp, 0x1604ccc4
jmp 0x432a38
cdq
rol edx, 2
jmp 0x4417b4
jle 0x449e78
jmp 0x436528
jmp 0x437feb
mov esp, ebp
pop ebp
ret
shl esi, 6
or ebp, 0xb1f27f42
jmp 0x438c24
je fcn.0044673a
jmp 0x440a73
jmp 0x433be3
je 0x438c24
jmp 0x448021
xor eax, ecx
cmp esi, 0x78425d9a
jmp 0x43e7c7
push eax
lea eax, [0x42fbf8]
call fcn.00432f8a
jmp 0x448fa8
lea eax, [ebp - 0x2bb]
cmp dword [eax], 0x4742444f
je 0x42fa6f
jmp 0x44540e
push edi
jmp 0x44709a
jmp 0x447e6f
jmp 0x4415f2
push edx
mov dword [esp], eax
push 0
call fcn.004422c6
push 0xffffffffffffffff
call fcn.004415f6
jmp 0x443ee3
sub al, 0x99
push 0x5654608e
pop edx
add edx, 0x815a2df4
add edx, ebp
jmp 0x446283
call fcn.00432857
mov edx, 0x729645cd
call fcn.004368be
push eax
rol eax, 3
push esi
push 0xaad60661
pop esi
jmp 0x440bce
jne 0x430293
jmp 0x445a53
jmp 0x434880
jl 0x43c115
jge 0x42e56d
not eax
jmp 0x43c109
call fcn.0042fbcd
cmp al, 0xa4
je 0x438c24
jmp 0x44a6b8
add edx, 0xdcf45d0b
jmp 0x43165e
jmp 0x43359e
jnp 0x44311a
adc ebx, 0xe5e0ee89
jmp 0x43246c
xchg dword [esp], ecx
mov ecx, dword [esp]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax]
je 0x432c5d
jmp 0x444bc4
ret
jmp 0x42f219
jmp fcn.00445b6f
xor edi, 0xe1c797d0
mov eax, 0xcff9c25
call fcn.004366f3
rol eax, 0x13
xor eax, 0xa21141d8
jmp 0x4382b7
jmp 0x44065c
ret
push 0xf92849a3
pop ecx
add ecx, 0x71b0c8b
jmp 0x441dd9
jne 0x436e1d
jmp 0x43e4ec
and ebp, edi
jmp 0x447ed8
Function at 0x44800b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], ebx
pop ebx
cmp dword [0x435700], 0
jne 0x43622a
call fcn.00443907

Function at 0x44934b
Capabilities:
Hash data using murmur3

Disassembly:
or esi, 0x6fee6e1f
add esi, 0x80447dae
xchg dword [esp], esi
jmp 0x43fde0
jmp fcn.0043780b
mov eax, edx
push esi
push 0xefde6b89
pop esi
add esi, 0x6998d281
jmp 0x43516d
mov dword [esp], ebx
pop ebx
imul byte [edx]
cmp al, 0xa4
jne 0x42e1bd
jmp 0x442440

Function at 0x44a37a
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
ror eax, 3
call fcn.0043fc89
ret
push ebp
mov ebp, esp
push eax
mov dword [esp], ecx
jmp 0x441177
jmp fcn.004340a8
jmp 0x4499f0
or ebp, eax
jmp 0x44370a
jne 0x443710
jmp 0x43d862
mov esp, ebp
pop ebp
push 0xe1c5db83
pop eax
and eax, 0xb7f37f78
cmp eax, 0x1cd6c791
jmp 0x43c8c1
jmp 0x44067c
add eax, 0x5e82e2c4
mov eax, dword [eax]
or eax, eax
jne 0x4343e1
call fcn.00432857
call fcn.004494ae
jmp 0x4400dd
jne 0x448d4e
call fcn.00440705
jl 0x4419f0
mov dword [eax], ecx
popfd
jmp 0x4419f0
jo 0x436868
jmp 0x43c384

Function at 0x44adfa
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
js 0x4359a2
xor ebx, 0xa85d3bdc
mov eax, dword [ebp - 4]
cmp byte [eax], 0xf1
jmp 0x435ec1
jne 0x42f514
jmp 0x44a4a9
cmp ebx, ebp
jmp 0x42f508
xchg dword [esp], eax
pop eax
cmp al, 0xa4
je fcn.00432a44
jmp 0x431ef9
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43ea34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x43ea30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43ea30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130