joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44aa70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x473660]
cmp byte [eax + 0xc], 0
je 0x44abdd
push 0x8000
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44abd6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x474b6c], 0
jne 0x44aac4
push 0x44abe4
call sub.KERNEL32.DLL_GetModuleHandleA_2
mov ebx, eax
push 0x44abec
push ebx
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b6c], eax
cmp dword [0x472dc4], 0
jne 0x44abbf
push 0x44abfc
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x472dc4], eax
cmp dword [0x472dc4], 0
je 0x44abbf
push 0x44ac08
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b70], eax
push 0x44ac18
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b74], eax
push 0x44ac2c
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b78], eax
push 0x44ac44
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b7c], eax
push 0x44ac5c
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b80], eax
push 0x44ac70
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b84], eax
push 0x44ac88
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b88], eax
push 0x44aca0
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b8c], eax
push 0x44acbc
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b90], eax
push 0x44acc8
mov eax, dword [0x472dc4]
push eax
call sub.KERNEL32.DLL_GetProcAddress_1
mov dword [0x474b94], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44abdd
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x44ef98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403ee0
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x44efe7
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00404150
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x456724
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x456774]
test si, 4
je 0x456738
or bl, 1
test si, 8
je 0x456742
or bl, 4
test si, 1
je 0x45674c
or bl, 8
test si, 2
je 0x456756
or bl, 0x10
test si, 0x10
je 0x456760
or bl, 0x20
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x45676f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x456778
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4567b0]
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x456791
or bl, 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4567a0
or bl, 4
test esi, 0x20000000
je 0x4567ab
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45ce58
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45ce6a
add esp, 0xfffffff0
call fcn.004034b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d6d8
mov eax, dword [0x4732c0]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d1fc
mov eax, dword [0x4732cc]
mov dword [eax + 4], ebx
mov dword [eax], 0x45d208
mov eax, ebx
call fcn.0045d214
push 0
call sub.USER32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x459630
push eax
push 0
push 0
mov eax, dword [0x473434]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41f188]
call fcn.00420824
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41f188]
call fcn.00420824
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41f188]
call fcn.00420824
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045d634
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d510
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d510
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45d510
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45cfa7
call fcn.0040350c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45d2f4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d49f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45d480
mov dl, 1
mov eax, dword [0x415c5c]
call fcn.00403160
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ee0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.USER32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45d46f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044ae2c
test al, al
je 0x45d462
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45d4b0
lea eax, [ebp - 0x254]
call fcn.00408df8
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45d462
xor eax, eax
push ebp
push 0x45d45b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45d4e8
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45d444
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404150
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45d444
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d462
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45d365
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419834
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d4a6
lea eax, [ebp - 0x260]
call fcn.00403ee0
ret

Function at 0x45ddd4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x474bb8]
cmp byte [eax + 0xa5], 0
jne 0x45de45
cmp dword [0x474bd0], 0
jne 0x45de06
call sub.KERNEL32.DLL_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45dd90
push eax
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x474bd0], eax
cmp dword [0x474bcc], 0
jne 0x45de21
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x474bcc], eax
cmp dword [0x474bd4], 0
jne 0x45de45
push esp
push 0
push 0
push 0x45dd34
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x474bd4], eax
pop edx
ret
Function at 0x45df3c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45df53
add esp, 0xfffffff0
call fcn.004034b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d6d8
mov eax, dword [0x47341c]
cmp word [eax + 2], 0
jne 0x45df7b
mov eax, dword [0x47341c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f614
mov eax, dword [0x4734e0]
cmp word [eax + 2], 0
jne 0x45df95
mov eax, dword [0x4734e0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045f80c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415840]
call fcn.00403160
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41fb90]
call fcn.00426ee8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45e11c
mov eax, dword [0x473330]
mov eax, dword [eax]
push eax
call sub.USER32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004272b8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45fdac
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x473330]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c86c
test eax, eax
je 0x45e08a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004087d8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c894
test eax, eax
je 0x45e09e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404150
mov eax, dword [0x4731f8]
cmp byte [eax], 0
jne 0x45e0d2
mov eax, ebx
call fcn.0045e244
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045ff88
mov eax, ebx
call fcn.0046094c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45e112
call fcn.0040350c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e4c4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x474bb8]
cmp dword [eax + 0x30], 0
je 0x45e56e
cmp dword [ebx + 0x94], 0
jne 0x45e568
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45e454
call sub.USER32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45e568
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.dll_GetWindowLongA
test al, 8
je 0x45e52e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45e568
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417ba8
push eax
call sub.USER32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45e53d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45f0d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45f105
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fd0
jmp 0x45f112
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f34
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460164
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4601a5
mov eax, esi
call fcn.00446398
test al, al
je 0x4601a5
mov eax, dword [ebx + 0x84]
call fcn.00446094
push eax
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x4601a5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446094
push eax
call sub.USER32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x461e70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4620d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x461ed3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00461938
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c3e0
cmp al, 1
jne 0x461ed3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00461c50
test al, al
je 0x46205f
cmp dword [ebp - 8], 0
jge 0x461ef1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00461938
mov eax, dword [ebp - 0x210]
call fcn.004041a0
cmp ebx, eax
jge 0x461f3b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00461938
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x473648]
and eax, 0xff
bt dword [edx], eax
jae 0x461f3b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x461f4f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00461e4c
cmp ebx, dword [ebp - 8]
je 0x462051
lea eax, [ebp - 0x108]
push eax
call sub.USER32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x461f7b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040338c
and eax, 0x7f
movzx eax, word [eax*2 + 0x473004]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x46203e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040338c
and eax, 0x7f
movzx eax, word [eax*2 + 0x473004]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.00446094
push eax
call sub.USER32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040338c
and eax, 0x7f
movzx eax, word [eax*2 + 0x473004]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00446094
push eax
call sub.USER32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462045
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4620b2
cmp dword [ebp - 8], 0
jge 0x46206a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00461938
mov eax, dword [ebp - 0x218]
call fcn.004041a0
cmp eax, dword [ebp - 8]
jg 0x4620a4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00461938
mov eax, dword [ebp - 0x21c]
call fcn.004041a0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00461e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4620d7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403f04
ret
Function at 0x46f528
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00406b78
ret

Function at 0x47b2de
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
or eax, eax
jne 0x49e8a2
jmp loc.004a5c8a

Function at 0x47b61f
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], ecx
pop ecx
lea eax, [fcn.0049dff8]
mov byte [eax], 0xc3
jmp loc.004ad39e

Function at 0x47b83d
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], eax
pop eax
push 0xc3bb3de8
xchg dword [esp], eax
jmp loc.0048d91e

Function at 0x47d195
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
push edx
call fcn.004a2e13
jmp loc.00495f79

Function at 0x4813c0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
add esp, 0xfffffff4
mov dword [ebp - 8], edx
jmp 0x4b181c
push ebp
mov ebp, esp
jns 0x47a760
jmp 0x4a1015

Function at 0x48a3d2
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
jo 0x4ae4dc
lea eax, [fcn.0048a3d2]
call fcn.004ab284
push 0x4905c3
jmp 0x4b988b
ret

Function at 0x48aab0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], ecx
pop ecx
pop ebx
push esi
push 0x8040c8b
pop esi
or esi, 0xced69b6b
xor esi, 0x3129601a
jmp 0x4ba629
pop edx
rol edx, 0x17
add edx, 0xe34c314f
xor edx, 0x6cdc3d06
xchg dword [esp], edx
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 8]
jmp 0x4a3c53
xchg dword [esp], esi
call fcn.0049593e
push eax
call fcn.004b665d
push edx
push 0x20179713
jmp 0x49eab0
jmp loc.0047cc8b
jmp 0x4a1640

Function at 0x48aad6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
js 0x49bcc4
add esp, 0xfffffff8
jmp 0x48e105
jmp 0x4ba1a4
jmp 0x49db19
ret
add esp, 0xfffffff8
mov dword [ebp - 8], edx
jmp 0x49079b
jmp 0x47c241
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push 0x49414e
jmp 0x494ce4
test esi, 0x10
jmp 0x49d592
xchg dword [esp], ecx
push 0xa70f0e6f
pop esi
xor esi, 0x64c2f0cf
and esi, 0x9a766c71
xor esi, 0x3e65c63c
jmp 0x4a8a80
call fcn.00494ba3
jmp 0x4b585d

Function at 0x48b236
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], edi
pop edi
popfd
xchg dword [esp], esi
jmp fcn.004b99c6

Function at 0x48cc8b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
lea eax, [0x4937b0]
mov byte [eax], 0xc3
jmp 0x49e8e1
Function at 0x48cf8e
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
rol eax, 0xe
push eax
jmp 0x495933
mov dword [0x4b9f2c], eax
jmp 0x4a24bd
push ebp
mov ebp, esp
push ebp
mov ebp, ecx
xchg dword [esp], ebp
mov esp, ebp
jmp 0x4b7ad9
xchg dword [esp], ecx
pop ecx
js 0x48aa48
push ecx
mov ecx, ebp
xchg dword [esp], ecx
mov ebp, esp
jmp 0x4a7698
ror eax, 0x10
jmp 0x4bbebb
xor eax, 0x7858b10e
ror eax, 0xb
mov edx, dword [esp]
push eax
mov eax, edx
call fcn.0048ea24
jmp 0x480dce
sub eax, 0xaf0cc2d5
js 0x48dafc
ror eax, 0x10
push eax
mov eax, edi
jmp 0x4b6063
add eax, 0x55c1f35
mov eax, dword [eax]
or eax, eax
jmp 0x49b2fb
jmp 0x4b7809
je 0x4ad444
jmp 0x480633
jl 0x4ab273
jmp 0x49de2f
jmp 0x4a7b5d
je 0x4ad748
jmp 0x4a34c5
ret
jmp 0x480a52
jmp 0x4b6fa7
push ecx
mov esp, ebp
pop ebp
push 0xa66b5726
pop eax
and eax, 0x44bdbc1a
add eax, 0xb6bf6665
jmp 0x4b5b3d
jne 0x480a53
jmp 0x4b8efb
and eax, 0xa0e4c6ff
jmp 0x498a20
call fcn.0049d014
mov edx, 0x95918c9d
call fcn.004b99c6
push eax
ror eax, 0xe
jmp 0x48aa3d
jne 0x498409
jmp 0x4ae789
imul byte [edx]
cmp al, 0xa4
je 0x49a201
jmp 0x4af923
jne 0x4b51a4
jmp 0x4bbfae
jmp 0x49a597
adc ebx, ecx
cdq
push 0x4a0f47
jmp 0x49e871
jmp 0x4bc791
jmp 0x47fff9
jne 0x480a53
jmp 0x47af3c
xchg dword [esp], ecx
mov ebp, ecx
pop ecx
mov eax, dword [0x4b9f2c]
or eax, eax
jmp 0x4a4273
jmp 0x49a237
jmp 0x492813
jb 0x4b3c91
jg 0x495b38
jmp 0x4b51a1
or eax, 0xd24f4db4
test eax, 0x40000000
jmp 0x4ada01

Function at 0x48d15a
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], esi
pop esi
add edi, 0x31a4716c
xchg dword [esp], edi
jmp fcn.004b99c6

Function at 0x48d1c7
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Inspect section memory permissions

Disassembly:
xchg dword [esp], eax
pop eax
push edx
call fcn.004ac6d0
jmp 0x4a448a
jmp 0x49d5b2
or edi, 0x970e2baa
sub edi, 0xf4f8a3bc
and edi, 0x131e2177
add edi, 0x9c5f2083
add edi, ebp
call fcn.004a286a
mov eax, 0x223944e3
call fcn.0048c8c2
jae 0x4b2c34
jmp fcn.004ae0bb
pop edi
xor edi, 0x65795d1d
jmp 0x48fb14

Function at 0x48d967
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x43ee6046
pop ebx
xor ebx, 0xf61bdc76
jmp loc.00497f6d
jne 0x47ba47
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
call fcn.0049904b
jmp 0x4b5cfd
ret
call fcn.00480027
push 0x4b6d9b
jmp 0x498f3e

Function at 0x48ec6d
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg dword [esp], ebx
pop ebx
push edx
call fcn.004ba6a0
push 0xaf386b4c
pop eax
xor eax, 0x5e50884d
or eax, 0xbc2f5aab
jmp loc.0047e929

Function at 0x48f0e7
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x4af633
push ecx
mov ecx, ebp
xchg dword [esp], ecx
jmp 0x4907e1
mov ebp, esp
jo 0x4bc818
add esp, 0xfffffff4
mov dword [ebp - 4], ecx
jmp 0x48ead2
ret
jmp 0x4a66bc
push 0x47a71a
jmp 0x4adc0d
add esp, 0xfffffff4
jmp 0x4bab9d