joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f200
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4242c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
je 0x40f293
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40f298
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40f28c
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
je 0x40f288
nop
cmp dword [ebp - 0x1c], 3
jne 0x40f288
push 0x3e8
call edi
lea edx, [ebp - 0x20]
push edx
push esi
call ebx
test eax, eax
jne 0x40f270
mov edi, dword [ebp - 0x24]
pop ebx
test esi, esi
je 0x40f298
push esi
jmp 0x40f29d
mov esi, dword [ebp - 0x24]
jmp 0x40f28c
test edi, edi
je 0x40f2a3
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00410969
mov esp, ebp
pop ebp
ret

Function at 0x40f2c0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4242c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40f390
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x40f389
push ebx
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x40f364
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x40f36f
cmp dword [ebp - 0x1c], 2
jne 0x40f36f
push 0x1f4
call edi
lea ecx, [ebp - 0x20]
push ecx
push esi
call ebx
test eax, eax
jne 0x40f332
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410969
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410969
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00410969
mov esp, ebp
pop ebp
ret

Function at 0x410969
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4242c0]
jne 0x410973
repz ret
jmp fcn.0041507a
Function at 0x41b28b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4242c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041608a
and dword [ebp - 0x14], 0
cmp dword [0x425ffc], 0
mov dword [ebp - 0x18], eax
jne 0x41b33e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b3e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41b3e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x425ffc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x426000], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x426004], eax
call edi
push eax
call esi
mov dword [0x42600c], eax
test eax, eax
je 0x41b33e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x426008], eax
mov eax, dword [0x426008]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b397
cmp dword [0x42600c], ecx
je 0x41b397
push eax
call esi
push dword [0x42600c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b397
test ebx, ebx
je 0x41b397
call edi
test eax, eax
je 0x41b38e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b38e
test byte [ebp - 8], 1
jne 0x41b397
or dword [ebp + 0x10], 0x200000
jmp 0x41b3ca
mov eax, dword [0x426000]
cmp eax, dword [ebp - 0x18]
je 0x41b3ca
push eax
call esi
test eax, eax
je 0x41b3ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b3ca
mov eax, dword [0x426004]
cmp eax, dword [ebp - 0x18]
je 0x41b3ca
push eax
call esi
test eax, eax
je 0x41b3ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x425ffc]
call esi
test eax, eax
je 0x41b3e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b3e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410969
leave
ret

Function at 0x4351b2
Capabilities:
Hash data using murmur3

Disassembly:
xor ebx, eax
add ebp, eax
xadd cl, ch
not cx
mov dword [esp + edx - 0x400000fe], edx
pop eax
pop eax
jne fcn.00523752
Function at 0x447922
Capabilities:
Hash data using murmur3

Disassembly:
not al
add edx, 0x25800b04
adc edi, 4
xor ecx, ebx
neg ecx
pop eax
xor edx, 0x24261f3f
or edx, 0xa73b9c29
lea ecx, [ecx + edx - 0x20a7179b]
ror edx, 0xa
movzx eax, dx
bt edx, edx
bswap ecx
sal al, 0xa2
bt eax, edx
call fcn.0052ba13
mov edx, 0xf51c2823
bt dx, 0x90
movzx ax, byte [edi]
movzx ecx, dx
imul dx, dx
sar dl, cl
mov cl, byte [edi + ecx - 0x2821]
dec dl
setg dl
adc edi, 2
not edx
xor al, dl
btr edx, edx
xor cl, dl
shr edx, 0xe5
sar edx, 0xa7
ja 0x49b2ec
and al, cl
btc edx, 0xb0
xor edx, edx
mov word [edi + edx], ax
movzx ecx, dx
and dx, cx
movzx eax, cx
lea esi, [edx + esi - 4]
jle 0x52c814
xor eax, ebx
xadd cx, dx
add cl, dh
ror eax, 2
add edx, ecx
neg ecx
dec cl
not eax
jbe 0x4d05c9
mov edx, 0x1facc1be
movzx ecx, dl
mov dx, word [edx + ebp - 0x1facc1be]
mov cl, byte [ebp + ecx*8 - 0x5ee]
mov eax, 0x6f98f43b
bts eax, 0xae
and ax, 0x9597
lea ebp, [eax + ebp - 0x6f989411]
shr dx, cl
movsx ecx, al
cbw
mov word [ebp + ecx*4 - 0x4c], dx
shl eax, cl
lea edx, [eax*8 - 0x164ccb72]
lea esi, [eax + esi - 0x980004]
btc edx, 0x31
jb 0x4b59fa
sub edi, 4
mov ecx, dword [edi]
mov edx, 0x5abca17
movzx eax, dl
xor ecx, ebx
imul edx
imul eax, edx
sar eax, 0x9e
rol ecx, 2
btc dx, dx
add dl, dl
xadd edx, eax
neg ecx
ror ecx, 1
inc al
sar edx, 0xea
xor ecx, 0x70b13e26
rol ecx, 1
xor ebx, ecx
inc dl
add ebp, ecx
mov eax, dword [esi + edx*8 - 8]
sub edx, edx
or dl, dh
je 0x49f165
mov cx, word [esi + edx - 0x752a2e01]
lea esi, [esi + edx - 0x752a2dff]
lea eax, [edx*4 + 0xf346324]
lea edi, [edi + edx - 0x752a2e02]
xor eax, edx
movzx edx, byte [edi + edx - 0x752a2e01]
adc ax, 0x5283
xor dl, bl
sub dl, 0x11
call fcn.004bee8b
mov edx, 0xd193052e
btc edx, 0x24
mov eax, dword [esi]
adc esi, 4
movsx ecx, dl
jmp 0x456c1e
mov cl, byte [esi + edx*4 + 4]
setae dl
btr edx, edx
lea esi, [esi + edx + 5]
neg dl
mov byte [edx + eax - 0xff], cl
movzx eax, dx
jmp ebp
ror ecx, 0xb6
inc eax
call fcn.004d12ed
mov ecx, 0x9e04551d
movzx eax, cl
movsx edx, cl
mov eax, dword [edi + eax - 0x1d]
lea ecx, [ecx*2 + 0x5b9b8506]
sar dx, 0x66
mov ecx, dword [edi + edx + 4]
sub edx, edx
shr edx, 0x54
lea edi, [edx + edi + 4]
adc dx, dx
and eax, ecx
call fcn.004784cc
Function at 0x4488ba
Capabilities:
Hash data using murmur3

Disassembly:
lea edx, [edx + ecx - 0x7cff42fa]
rol edx, 1
btc ax, 0x39
shr byte [esp + 2], cl
bswap edx
cbw
neg byte [esp + 1]
sbb edx, 0x153cb73d
sub word [esp + 2], cx
bswap eax
xor edx, 0xdc1ca912
dec eax
jle 0x50db7c
sub edx, 0xcb3a54a8
neg edx
xor ebx, edx
shl al, 0xe1
rol eax, cl
add esi, edx
pop ecx
jmp esi
mov word [ebp + eax - 0xfc], dx
mov dword [esp + eax*2 - 0x1f4], 0x8331a5bf
lea esi, [esi + eax - 0x100]
lea ecx, [eax*2 - 0x7dd00dc5]
mov dword [esp + eax - 0xfc], 0x22bb88a5
jb 0x431d6a
mov ecx, dword [esi + eax*8 - 0x7e0]
adc ax, ax
movzx edx, ax
add dx, ax
xor ecx, ebx
bswap ecx
div dword [esp + eax*2 - 0x3ee]
add edx, dword [esp + eax - 0x60c]
lea ecx, [ecx + edx*2 - 0x68811a45]
ror ecx, 1
cwde
call fcn.0051ac25
ror eax, 2
xadd dword [esp + edx*4 - 0x107d], edx
shr ecx, cl
xor dword [esp + ecx*2 - 0x146], 0xa0ad70a4
inc eax
call fcn.00504e51
mov ecx, 0x428e1912
mov ecx, dword [edi + ecx - 0x428e1912]
mov eax, 0xcd28ac01
movzx edx, al
mov dx, word ss:[ecx + edx*4 - 4]
mov ecx, eax
push ecx
add word [esp + 2], ax
adc edi, 1
xadd cx, ax
rol dword [esp], cl
sbb word [esp], cx
mov word [edi], dx
sbb ebp, 4
movzx edx, word [esp]
rol dx, 0xcc
setb dl
mov edx, dword [edx + ebp - 0x2500]
sub ax, 0x829f
xor edx, ebx
bt eax, eax
jae 0x42e6d9
mov eax, 0x1732f53c
movsx edx, ax
lea ebp, [ebp + eax*2 - 0x2e65ea7c]
movzx ecx, al
and cx, ax
mov eax, dword [ebp + eax - 0x1732f53c]
add dl, 0x11
call fcn.0049acc7
Function at 0x45292a
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
rol byte [esp + ecx - 0x480201a], 0xa6
not dword [esp + ecx*2 - 0x9004038]
rol eax, 0xc5
neg edx
xor word [esp + ecx*4 - 0x1200806e], 0x2bba
xadd word [esp + ecx*2 - 0x9004038], cx
rol edx, 1
neg dword [esp + ecx - 0x4803f07]
seta cl
sar eax, 0x74
bswap edx
shl cl, 0x62
sbb edx, 0xe1383298
push ecx
xadd dword [esp + ecx - 0x4803efc], ecx
xor edx, eax
xor ebx, edx
shr cx, 0x6e
inc ax
jle 0x4713d9
ror eax, 1
mov dword [esp + 4], edx
add dl, 0x1e
xor ebx, eax
rol ecx, 0x1b
add edi, eax
push ecx
ror byte [esp + 9], 0x81
movzx eax, cx
mov edx, dword [ebp + eax*4 - 0x109cc]
mov dword [esp + eax - 0x4267], eax
mov dword [esp + eax*8 - 0x21394], 0x1dbf5889
sbb ecx, ecx
or cl, byte [ecx + ebp + 4]
lea ebp, [eax + ebp - 0x4271]
and eax, 0xeb08f23c
call fcn.004e34d0
jnp 0x44b872
add ebp, edx
pop ecx
pop eax
jmp ebp

Function at 0x47beed
Capabilities:
Hash data using murmur3

Disassembly:
jge 0x47bef4
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x18]
call fcn.004844ea
mov edx, dword [esp + edx*4 + 0x636e1a9c]
mov edx, dword [esp + edx + 0x5f0dfb2b]
jne 0x46af88

Function at 0x484004
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.004890c2
movsx eax, dl
xor dx, ax
jae fcn.004e21c3
mov eax, 0x8916dc3f
lea ecx, [eax*8 - 0x19d4054a]
lea eax, [eax + ecx*2 + 0x4210148b]
lea esi, [esi + ecx - 0x2ee2dcb2]
movzx edx, cl
shr ax, cl
or dx, dx
mov edx, dword [esi + eax*2 - 0x51d80004]
bts ax, cx
add al, 0xb8
xor edx, ebx
sub cl, al
dec cx
adc eax, eax
sbb edx, 0xd8a1aa1d
imul eax, ecx
rol edx, 2
bswap edx
not eax
neg cx
lea edx, [edx + ecx - 0x1c4af97c]
not edx
dec edx
xor ebx, edx
add ebp, edx
xchg ecx, eax
shl eax, cl
mov di, word [edi + eax*2 - 0x461a0000]
sub cx, ax
movzx edx, cx
jne fcn.0044c0be
push ebx
push ecx
mov ecx, 0xafacbebf
pushfd
add cl, cl
mov ebx, 0xd7b1260a
or cl, 0x39
mov ebx, dword [esp + ecx + 0x50534189]
mov dword [esp + 8], 0x5c5b6e98
mov ecx, dword [esp + ecx + 0x50534185]
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.00469123

Function at 0x485b6f
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
add ebp, 6
push 0xbb47ead
call fcn.004daba0
bswap ecx
cwd
add word [esp + eax - 0x693e9e], dx
dec edx
dec ecx
lea eax, [edx*4 - 0x4f726666]
add byte [esp + eax - 0xd499995], 0x14
xor ebx, ecx
add esi, ecx
shl byte [esp + eax - 0xd499993], 0x87
mov dword [esp + eax*4 - 0x35266658], esi
ret
jmp 0x4ea38f
sal dl, 0xa7
xor bx, cx
mov dword [esp + edx - 0x7c], eax
mul eax
cmovae edx, eax
lea edi, [edi + edx - 0x402]
mov word [edi + edx - 0x400], cx
mul edx
bt eax, eax
push edx
pop eax
pop edx
pop eax
pop edx
pop ecx
jae fcn.004d0428
mov ecx, 0xd687c53d
lea eax, [ecx + ecx*8 + 0x1902e61c]
sub esi, 4
mov edx, dword [esi]
add cl, ah
sar ecx, cl
sbb al, ch
xor edx, ebx
rol edx, cl
not edx
ror edx, 3
cbw
inc edx
shr ax, cl
xor ebx, edx
add edi, edx
mov edx, dword [ebp]
bts eax, ecx
and eax, 0x9ba05299
shl ecx, 0x7f
mov eax, dword [ebp + ecx - 0x7ffffffc]
jp 0x51678c
jmp 0x472410
xor cl, ch
sub ecx, ecx
xor cl, byte [ebp + ecx + 8]
jmp 0x47eed6
Function at 0x489426
Capabilities:
Hash data using murmur3

Disassembly:
mov word [ebp], ax
inc cl
sar dword [esp + 7], cl
mov dword [esp], 0xba0f2f22
pop eax
pop edx
pop eax
jp fcn.004b99d8

Function at 0x48c487
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
xchg dword [esp + edi*2 + 8], edi
mov dword [esp + edi*2 - 0x6d82f956], ebx
lea edi, [esp + edi - 0x36c17cb5]
mov dword [esp], edx
movzx ebx, byte [esp]
xadd dword [esp + ebx - 0xff], edx
lea edx, [edi + ebx*8 - 0x8d8]
mov dword [esp + ebx - 0xfb], 0xd584de26
lea esi, [ebx + ecx*2 - 0x3b7a2750]
movsx eax, cx
mov esp, edx

Function at 0x48dee8
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov cx, word [eax + ecx - 0x990ff01]
lea edx, [edx*8 - 0x7d6ace56]
ror dx, 0xe6
sbb dl, byte [esp + 4]
sbb ebp, 2
and dword [esp + 4], edx
mov word [ebp], cx
lea ecx, [edx + edx*4 + 0x7f941c83]
mov eax, ecx
pop edx
pop edx
jne fcn.004ea950
Function at 0x49bf0c
Capabilities:
Hash data using murmur3
Manually build aes constants

Disassembly:
shl dl, cl
lea ecx, [eax - 0x2cf26875]
mov word [ebp + eax*8], dx
or eax, edi
jmp eax
neg edx
sar ecx, 0xfa
lea edx, [edx + eax*2 + 0x7c4aaa3d]
xor eax, eax
call fcn.004ff34e
not al
xadd ecx, edx
not dword [esp + edx*2]
xor bl, al
lea eax, [esp + eax + 4]
xor dx, word [eax + edx*2]
push ecx
movsx eax, byte [esp + 4]
btr ax, cx
lea ebp, [ebp + eax*2 - 0x100]
xchg dword [esp + eax*2 - 0xfd], eax
cwde
mov word [eax + ebp - 0x5a52], dx
cdq
mul edx
imul edx
pop ecx
pop ecx
jae fcn.004b99d8
mov eax, 0xf1988f1e
movzx ecx, al
movsx edx, al
mov eax, dword [edi + ecx*2 - 0x3c]
lea ecx, [edx*8 + 0x771b9aba]
not cl
btr ecx, ecx
mov ecx, dword [edi + ecx - 0x771b9b51]
btc dx, 0x25
xor edx, edx
lock xadd dword [edx + eax], ecx
pushfd
not dl
lea eax, [edx + edx*4 - 0x69d6045a]
call fcn.004f3ab6
sub esi, 4
mov eax, 0x20995c31
mov eax, dword [eax + esi - 0x20995c31]
xor eax, ebx
mov ecx, 0xae02490c
neg cx
bswap eax
inc eax
movsx edx, cx
lea ecx, [edx + ecx*2 + 0x5da29312]
btr edx, 0x98
neg eax
dec eax
and edx, ecx
xor ebx, eax
inc cl
add edi, eax
movzx eax, cx
bswap eax
mov edx, dword [ebp]
add ax, word [ebp + 4]
xor ecx, ecx
xor cl, 0x34
not cx
lea ebp, [ebp + ecx*2 - 0x1ff90]
inc ecx
mov word ss:[edx + ecx*2 - 0x1ff98], ax
movsx eax, cx
dec ecx
movsx edx, cl
jmp edi
adc ax, cx
xor ebx, edx
add edi, edx
mov edx, 0xf5144182
lea edx, [edx - 0x41e5fd62]
lea esi, [esi + eax*2 - 0xf431f01]
movzx eax, byte [eax + esi - 0x7a18f80]
and ecx, edx
lea edx, [ecx*2 + 0x23cb42f]
xor al, bl
rol cl, 0xa1
neg al
btr cx, 0xbe
rol ecx, 0x16
shr edx, cl
dec al
neg edx
bts ecx, 0xb2
not al
sub ecx, edx
and ecx, ecx
xor al, 0x1b
sal cl, 0x46
xor bl, al
dec dl
bt edx, ecx
setb dl
adc eax, esp
or cl, dh
dec dx
mov dx, word [eax + ecx - 0x34796961]
movzx eax, cx
xadd eax, ecx
lea ebp, [ebp + ecx*4 - 0x1a586]
adc eax, 0x5920359b
setno cl
not eax
mov word [ebp + ecx*2 - 0xd200], dx
js fcn.0043bab6
add edi, edx
lea eax, [eax + ecx*4 + 0x1a00b83f]
and ax, cx
movzx dx, byte [ebp + eax - 0x7a890d02]
mov cl, byte [ebp + eax - 0x7a890d00]
btr eax, eax
lea eax, [eax + eax + 0x5a94ceb5]
and ax, ax
lea ebp, [eax + ebp - 0x4fa6e8b7]
sbb eax, eax
je 0x440d3b
mov dword [esp + ecx - 0xbc9f], 0x99292f88
shr eax, 0xf8
xor edx, 0xc33e4721
xchg dword [esp + ecx*4 - 0x2f27c], ecx
inc cx
js 0x4f4f6c
lea edx, [edx + eax*2 + 0x511b8228]
rol al, 0xa4
not ecx
bswap edx
neg dword [esp + ecx - 0x66d6d076]
rol edx, 3
rol ecx, 0xb4
sal eax, cl
sar dword [esp + ecx - 0x7666d6d], 0xb4
xor edx, 0xb58862a8
shl ecx, cl
pop ecx
ror edx, 1
sal al, 0x44
add eax, eax
sub eax, eax
xor edx, ecx
xchg ecx, eax
lea edx, [ecx + edx - 0x76870e3a]
sal al, 0xa6
neg ax
xor cl, ah
not edx
lea eax, [eax*8 + 0x3f234a2a]
jae 0x48b408
mov edx, 0x50837819
movsx eax, dx
btc ax, ax
lea esi, [esi + eax - 0x7a1d]
cwde
mov edx, dword [esi + eax*2 - 0xf432]
lea ecx, [eax - 0x477dcb4d]
imul ecx, eax
shl eax, cl
xor edx, ebx
and ecx, 0x87391091
bswap edx
lea edx, [edx + eax*8 + 0x7ef438ad]
jns 0x4e34e6
ror edx, 1
neg ecx
lea edx, [eax + edx - 0x3d49a19a]
and eax, eax
jg 0x4993b7
Function at 0x4a55e9
Capabilities:
Hash data using murmur3

Disassembly:
dec ecx
not dl
call fcn.00494658
mov ecx, 0x93b553b4
mov ecx, dword [esi]
add esi, 4
mov eax, 0xa4a153b5
lea edx, [eax + eax*2 - 0x265436fa]
add eax, eax
xor ecx, ebx
add al, dh
btc edx, eax
cmovae eax, edx
rol ecx, 2
sub ecx, 0x84a86e2d
neg ecx
xadd dl, dh
not ecx
sal ax, 0x42
sub al, dh
call fcn.0047ca89

Function at 0x4a6903
Capabilities:
Hash data using murmur3

Disassembly:
sal edx, 0x62
lea eax, [eax + edx - 0x316c7f4f]
mov dword [esp + ecx*2 - 0x272a], ecx
call fcn.0044d61b
push 0x78139ca4
inc dword [esp]
sub esi, 4
mov eax, 0x41e95b0
mov eax, dword [eax + esi - 0x41e95b0]
mov ecx, 0x66273183
or dword [esp + ecx - 0x66273183], 0xceab9d07
inc dword [esp + ecx - 0x66273183]
xor eax, ebx
xor eax, 0xbbbb723c
shl ecx, 0x8b
adc byte [esp + ecx - 0x398c17fe], ch
lea eax, [ecx + eax - 0x6923c58a]
dec byte [esp + ecx - 0x398c17fe]
mov edx, 0x7da7070f
ror eax, 1
lea eax, [eax + ecx*2 + 0x4dee3705]
xor eax, 0xb34a78f
sub dl, dl
not eax
neg dword [esp + edx - 0x7da70700]
rol edx, 0xa8
xor ebx, eax
add edi, eax
pop eax
or edx, ecx
call fcn.004f0f17

Function at 0x4aa39c
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.004846f0
pop eax
pop ecx
pop ecx
pop ecx
jb fcn.004e21c3
neg dx
inc ax
rol ax, 0x41
bts ecx, 0x8c
xor dx, 0xfaa6
add dx, 0x329f
xor byte [esp + ecx - 0x4ab3f1a3], ch
adc dword [esp + eax - 0x4aafa953], ecx
not dx
sete byte [esp + eax - 0x4aafa952]
shl byte [esp + ecx - 0x4ab3f1a3], 0x65
sub dword [esp + eax - 0x4aafa95b], 0xb36e03a
inc dx
call fcn.0047ee3e
mov dword [esp], 0xdc19d1ae
and edx, 0xfffffffc
call fcn.004a7155
mov edx, dword [ebp]
jmp 0x4754a4

Function at 0x4abae5
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
xor eax, ebx
call fcn.004e6b12
jmp loc.0040f8c9

Function at 0x4b7270
Capabilities:
Hash data using murmur3

Disassembly:
mov word [ebp + eax - 0x5940b2], cx
pop edx
pop ecx
pop edx
pop edx
pop edx
js fcn.004e21c3

Function at 0x4bf9f5
Capabilities:
Hash data using murmur3

Disassembly:
sbb esi, 3
mov dword [esi], ecx
sub edi, 4
ror al, 0x82
mov ecx, dword [edi]
imul dx, word [esp + 2]
xor ecx, ebx
bswap ecx
mov dword [esp + 4], 0x44b0bb03
push edx
add ecx, 0x4d2249b5
cdq
bswap eax
xor ebx, ecx
and ax, word [esp]
bts edx, 0xa6
jb 0x43cdd4

Function at 0x4c76e5
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, 0x2212c604
lea edi, [edi + eax - 0x2212c600]
mov dword [esp + eax*2 - 0x44258c08], eax
xor edx, ebx
cwde
xor edx, 0x470f1f1d
movzx ecx, al
sar al, 0x87
neg ax
lea edx, [edx + ecx*2 - 0xe800e37]
push ecx
mov dword [esp + ecx*2], eax
inc byte [esp + ecx + 1]
bswap edx
adc ax, word [esp + ecx + 4]
xor al, al
or ecx, eax
ror edx, 3
xor ebx, edx
add esi, edx
sar ax, cl
sbb byte [esp + 5], al
mov ax, word [ebp]
neg ecx
push ecx
movsx edx, word [esp + ecx*4 - 0x22fef]
mov cl, byte [ebp + ecx*2 - 0x117f6]
lea ebp, [ebp + edx*8 - 0x456]
sar word [esp + edx*2 - 0x108], 0x44
shr ax, cl
ror dl, 0x24
mov word [ebp + edx*4 - 0x2e0], ax
jb 0x4e0d9c
mov dword [esp + edx - 0xb8], esi
ret 0xc
Function at 0x4c95b1
Capabilities:
Encode data using base64
Hash data using murmur3

Disassembly:
mov edi, eax
cld
mov dword [esp], 0x6c16581e
rep movsb byte es:[edi], byte [esi]
push dword [esp + 4]
popfd
push 0x4c0a56ad
mov esi, dword [esp + 0xc]
push 0x7c3c12a0
mov dword [esp + 0x10], 0x2eaa2c22
call fcn.0050685b
pop edx
mov edx, dword [ebp]
mov dword [esp], ecx
mov al, byte [ebp + 4]
call fcn.00444e44
Function at 0x4d12ed
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], 0xfda69815
rol ecx, cl
neg eax
xor ebx, eax
add dword [esp], 0x768c6e10
setg cl
or cl, 0xa7
adc edi, eax
lea eax, [ecx + ecx - 0x157e59f2]
btr eax, eax
movzx eax, byte [esi]
sbb cl, cl
adc esi, 1
xor al, bl
not al
btc ecx, ecx
adc word [esp + 1], 0xf6bb
setbe cl
xor al, 0x19
rol dword [esp], 0xf2
add al, cl
ror al, cl
lea ecx, [ecx*4 - 0x22591cce]
neg cx
rol word [esp], cl
xor bl, al
sub ebp, 2
mov word [ebp], ax
and byte [esp + 2], dl
pop ecx
js fcn.004b99d8
mov edx, 0x92abb324
mov edx, dword [ebp]
add ebp, 4
mov eax, 0x1b0e1aa5
xor edx, ebx
lea ecx, [eax + eax*4 - 0x5d76bef8]
sar eax, 0x37
bt ecx, ecx
neg edx
rol edx, 3
cbw
bswap edx
rol edx, cl
lea ecx, [eax + ecx*4 - 0x4266ec44]
ror cx, 0x8f
inc al
inc edx
add al, al
shl al, 0x82
xor ebx, edx
inc cx
add eax, ecx
adc cx, cx
adc esi, edx
shl eax, 0x12
inc ecx
mov edx, dword [eax + edi - 0x6a940000]
sub eax, ecx
rol al, 0xe6
mov eax, dword [eax + edi - 0x5bb4c45]
adc cx, 0xeb00
mov cl, byte [edi + ecx - 0x64d89ed4]
adc edi, 5
push 0xdd058a11
call fcn.004b97b7
Function at 0x4db37e
Capabilities:
Hash data using murmur3

Disassembly:
cdq
mov eax, dword [edi + eax*2 - 0x9f17c]
xor edx, dword [edi + edx + 4]
mov cl, byte [edi + 8]
add edi, 6
shrd eax, edx, cl
mov dword [edi], eax
jmp ebp
mov edx, dword [edi]
movsx eax, cl
neg cx
adc edi, 3
sar eax, cl
xor cx, ax
xor edx, ebx
sub edx, eax
btr eax, ecx
bt ecx, eax
xor edx, 0x7db0ec80
xadd cl, al
neg edx
shr cl, 0xc3
jne 0x4bdfbe
bswap edx
xor cl, al
xor ebx, edx
xadd al, ch
sal eax, cl
add esi, edx
bts eax, eax
sub ecx, ecx
mov ebp, dword [ebp + ecx*2]
sub eax, 0xe6372018
jne fcn.0050912d
cmp ebp, ecx
call fcn.00477003
jno 0x49b682
bswap ecx
shl edx, 0xd1
setne al
not ecx
jnp 0x44c46a
adc eax, 0xf73ea11a
xor ebx, ecx
add edi, ecx
xadd eax, edx
mov ecx, 0xf83c889a
imul eax
movzx ax, byte [ebp + edx*2 - 0xc39a566]
jb 0x5015d5
sub esi, 4
mov eax, 0x4983b811
mov ecx, dword [esi + eax - 0x4983b811]
xor ecx, ebx
ror ecx, 1
dec ax
sub ecx, 0x44381e8b
movsx edx, al
ror ecx, 1
inc ax
not ecx
sal ax, 0xaf
neg ecx
shr eax, 0xec
xor ebx, ecx
or ax, 0xe8a6
adc ebp, ecx
sub dl, dl
jae 0x439236
rol dl, 0xe7
inc ecx
mov dl, byte [ebp + edx*2 - 0xc39a5b0]
adc ebp, 1
not al
bts ecx, ecx
not dl
or ecx, ecx
call fcn.004ffaa3
xor cx, 0x319c
or al, ah
sbb edx, edx
inc cx
not al
xor cx, 0x3b94
add edx, eax
cdq
xor bx, cx
mul edx
lea edi, [edi + eax*4 - 2]
cwd
add al, ah
sbb eax, 0x1f138e18
mov word [edi + edx*2], cx
sal eax, 0x9d
mov ecx, dword [eax + ebp]
ror edx, 0x65
lea ebp, [ebp + eax + 4]
xor ecx, ebx
call fcn.00469934
rol ecx, 1
bt dx, 0x37
adc edx, edx
mov dword [esp + eax - 0x1b0aca81], eax
xor ebx, ecx
idiv eax
cwde
add esi, ecx
mov eax, dword [ebp]
bts dx, 5
mov dx, word [ebp + 4]
call fcn.0050ca6b
mov ecx, 0x28987f84
lea ebp, [ebp + ecx - 0x28987f88]
lea edx, [ecx*4 + 0xea26639]
movsx eax, dl
shr ax, 0x64
mov ecx, dword [ecx + ebp - 0x28987f84]
imul edx
lea eax, [edx*8 + 0xc39dd9d]
xor ecx, ebx
rol ax, 0xa
add eax, edx
adc ecx, edx
cwd
inc edx
bt dx, ax
rol ecx, 3
xor eax, eax
sub dl, dh
cwde
not ecx
neg ecx
mul dx
xchg edx, eax
xor ebx, ecx
bt ax, dx
adc esi, ecx
movzx ecx, ax
or dx, word [edi + edx*8]
lea ecx, [ecx*2 + 0x3002d33a]
mov cl, byte [edi + ecx*2 - 0x6005a672]
sar al, 0xa2
or eax, eax
inc eax
adc edi, 2
shl dx, cl
mov ecx, eax
inc al
mov word [edi], dx
lea edx, [eax - 0x3e848ed]
jmp esi

Function at 0x4dc75a
Capabilities:
Hash data using murmur3

Disassembly:
cdq
sub ecx, 0xc8020b9
ror ecx, 2
xadd dl, al
mov dword [esp], 0x3b805426
add dx, 0xeeac
sbb ecx, 0x5316a3ac
cdq
sar eax, 0x38
bswap ecx
or dl, 0x2f
xor ax, word [esp + 2]
xor ebx, ecx
pop edx
ror edx, 0x38
add ebp, ecx
mov edx, dword [esi]
mov ax, word ss:[edx]
mov edx, 0xb192cc93
mov ecx, edx
add esi, 2
inc cl
bswap edx
jg 0x453cc3
mov word [esi], ax
jmp ebp

Function at 0x4e4494
Capabilities:
Hash data using murmur3

Disassembly:
not eax
ror cx, cl
ror cl, 0xe5
adc ecx, ecx
inc eax
lea ecx, [ecx*8 - 0x30dd56dc]
mov dword [esp], ecx
push ecx
xor eax, 0xa30ca133
shl cl, cl
dec eax
neg eax
dec dword [esp + 4]
xor ebx, eax
mov dword [esp + 4], 0xb82448a9
add esi, eax
and word [esp + 5], cx
ja 0x4f7bf6