joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30477
Capabilities:
Hash data using murmur3

Disassembly:
push dword [esp]
xchg dword [esp + 0x20], esi
not esi
sar si, cl
clc
mov esi, dword [eax]
adc al, cl
stc
shr ah, 1
bsr ax, cx
mov dword [esp + 0x1c], edi
movsx eax, bl
lea eax, [esi + 0x7eec7f83]
jmp 0x32acd
lea esp, [esp + 0xc]
jb 0x1979d
inc al
pushal
sar ah, cl
mov eax, dword [0x17ce0]
jmp 0x191b4
lea eax, [ebp - 0x9c]
stc
pushfd
test ah, ah
push 0x961640d
mov dword [esp + 0x20], eax
test ebp, 0xbb182b37
add esi, 4
jmp 0x3dff3

Function at 0x3056b
Capabilities:
Hash data using murmur3

Disassembly:
or esi, edi
add di, 0xcecd
movzx edi, byte [eax + 1]
pushal
cmc
jmp 0x1b071
inc dword [ebp - 0xb8]
cmc
pushfd
test bp, di
cmp dword [ebp - 0xb8], 0x40
pushfd
push eax
push dword [esp]
lea esp, [esp + 0x4c]
jne 0x37d15
neg ah
sub ecx, ecx
bt ax, 4
shld ax, si, cl
inc di
lea eax, [ebp - 0xf7]
sub si, 0x102d
shld di, dx, 5
movzx esi, byte [eax - 1]
bts edi, edi
rcr di, 2
cmc
adc di, 0xc6f2
movzx edi, byte [eax]
pushfd
shl esi, 8
push ecx
cmp bx, sp
clc
jmp 0x1ec0f

Function at 0x3070c
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
push dword [esp]
lea esp, [esp + 8]
jne 0x36cb8
shld ax, bp, cl
sar ax, cl
mov esi, dword [edi + 0x14]
sbb ah, bh
shld ax, di, cl
mov eax, dword [esi]
bt ax, cx
call fcn.0003a45d

Function at 0x30997
Capabilities:
Hash data using murmur3

Disassembly:
dec esi
pushfd
pushfd
mov word [esp], di
mov dword [eax + 4], edi
mov dword [esp], 0xe79f631d
mov byte [esp + 0x20], 0x49
jmp 0x38117
mov byte [esp], bl
lea esp, [esp + 0x50]
jne 0x1b634
call fcn.0002d0a4

Function at 0x3114e
Capabilities:
Hash data using murmur3

Disassembly:
cmc
shl edx, 8
test eax, 0xe556d0d2
mov word [esp], 0xc5ea
cmp esi, ebx
or edx, edi
btr di, bp
rol di, cl
lea edi, [0x1c5fb977]
rcl edi, 7
movzx edi, byte [eax + 2]
clc
shl edx, 8
cmp cl, bh
or edx, edi
jmp 0x34800
mov byte [esp + 8], al
call fcn.0003aa96
lea esp, [esp + 0x3c]
call sub.ntoskrnl.exe_memcpy
setge ah
sal ah, 1
mov eax, dword [ebp + 0xc]
stc
add esp, 0xc
stc
stc
stc
cmc
cmp dword [eax], 1
push 0xd16cc8a3
mov dword [esp], esi
push edx
pushal
setne al
call fcn.0003624f
jmp 0x3d52d
bt dx, 0xd
xor edi, ecx
shl cx, cl
bswap ecx
lea ecx, [ecx - 0x13cdd74c]
btc cx, di
mov ecx, dword [eax - 0x34]
call fcn.0003a981

Function at 0x31503
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [ebp - 0x48]
jmp fcn.0002066e
mov eax, dword [ebp - 0x1b4]
bswap cx
mov cl, byte [esp]
jmp 0x1d449

Function at 0x31514
Capabilities:
Hash data using murmur3

Disassembly:
shr ecx, 3
push ebp
pushal
test bl, ah
test bl, 0x77
xor esi, ecx
ror cx, 0xb
btc cx, 0xd
clc
mov ecx, dword [eax]
mov word [esp], 0x8a57
stc
jmp 0x39ed1
rol edi, 0xf
pushfd
push edi
lea esp, [esp + 0x38]
jmp 0x24bf5

Function at 0x3162f
Capabilities:
Hash data using murmur3

Disassembly:
btc esi, 0x12
lea esi, [0x2c2e1b33]
rol edx, 0xf
btc esi, 7
mov esi, ecx
pushfd
jmp loc.00013534
Function at 0x317d3
Capabilities:
Hash data using murmur3

Disassembly:
push edx
push 0x88d2b014
lea esp, [esp + 0x50]
jne 0x36cb8
add ah, cl
mov esi, dword [edi + 0x14]
jmp 0x3b6b0
pushal
dec eax
pushfd
jmp 0x2dffe
dec ah
mov eax, dword [esi]
pushal
stc
push ebx
test al, 0x7a
mov byte [esp + 8], 0x6d
mov byte [esp], 0xbe
mov dword [esp], 0xde19eeb3
jmp fcn.00010b05

Function at 0x31f1a
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push 0x265316f2
dec eax
mov byte [esp], 0x7d
push dword [esp]
mov byte [esp], dh
jmp 0x1f71a
pushal
pushal
pushfd
mov dword [ebp - 0xc], eax
pushfd
lea esp, [esp + 0x48]
call fcn.0002758c
sal cx, cl
mov ecx, dword [ebp - 0xc]
cmc
test cl, cl
cmp dword [ebp - 4], ecx
push 0xb1d5f3bd
lea esp, [esp + 4]
je 0x25b9c
cmp ch, dl
jmp 0x31343
cmp eax, ebx
pushfd
jmp 0x35cfa
pushfd
lea esp, [esp + 0xc]
call fcn.0002758c
jl 0x37545
pushal
push dword [ebp - 4]
pop dword [esp + 0x1c]
pushfd
mov dword [ebp - 0xc], eax
call fcn.0001d21d
lea esp, [esp + 4]
je 0x25b9c
lahf
mov eax, dword [edi]
jmp 0x18f08
pushfd
push dword [ebp - 4]
pop dword [esp]
jmp 0x1ee9e

Function at 0x32b61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setnp ch
mov ecx, dword [ebp - 0x128]
pushfd
mov al, byte [ebp + eax - 0x18]
mov word [esp + 0xc], 0x4c2
pushal
mov dword [esp], ecx
mov byte [ebp + ecx - 0x168], al
call fcn.000374a6

Function at 0x32b86
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
bt ax, 0xa
clc
add dword [ebp - 0xa4], eax
aam 0x55
mov eax, dword [ebp - 0x1a8]
bt bp, 5
add dword [ebp - 0x9c], eax
xor al, al
sar ah, 4
das
mov eax, dword [ebp - 0x19c]
bt ax, di
clc
add dword [ebp - 0x94], eax
stc
sar al, cl
push edi
mov eax, dword [ebp - 0x1a4]
test ah, cl
add dword [ebp - 0x90], eax
movzx ax, cl
cmp cx, 0x318b
sal ax, cl
jmp 0x33080
mov eax, dword [ebp - 0x1ac]
jmp 0x3fb39

Function at 0x330b2
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x54]
jne 0x214b3
and si, cx
test dl, ch
xor si, sp
sub ecx, ecx
rcl ah, cl
aam 0x41
lea eax, [ebp - 0x87]
shld di, dx, 9
xchg si, di
movzx esi, byte [eax - 1]
movzx di, cl
shrd edi, ecx, 0x1a
movzx edi, byte [eax]
pushal
cmc
shl esi, 8
mov byte [esp + 0xc], 0x3f
or esi, edi
btr edi, 0xe
sar edi, 0xf
call fcn.000302ea
Function at 0x333fa
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], ch
mov dword [esp], 0x5528cb67
dec dword [ebp - 0x1bc]
mov byte [esp], dh
lea esp, [esp + 0x60]
jle 0x3e63e
mov dword [eax + 4], esi
jmp 0x31240
jmp 0x1f147
push 0x66a17052
pushal
mov dword [eax + 4], esi
push dword [esp]
lea esp, [esp + 0x28]
jne 0x1484a
setge dh
cwde
inc al
mov eax, dword [ebp - 0x34]
ror edi, 1
and esi, ecx
inc di
mov esi, dword [ebp - 0x38]
sub dx, 0x5f69
xor dl, 0x38
shld dx, di, 0xc
dec di
mov edi, dword [ebp - 0x20]
movsx dx, bl
shld dx, bx, cl
bsf dx, di
shr dl, cl
mov edx, dword [ebp - 0x28]
push esp
and dword [ebp - 0x1a0], 0
mov byte [esp], 0xee
mov word [esp], dx
mov dword [ebp - 0x198], eax
push dword [esp]
setno ah
bt bp, ax
mov eax, dword [ebp - 0x30]
pushal
mov dword [ebp - 0x19c], eax
jmp 0x4039f
mov eax, dword [ebp - 0x2c]
stc
mov dword [ebp - 0x194], eax
jmp 0x40ed7

Function at 0x3345a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [ebp - 0x1a0], 4
stc
cmc
test bh, 0xa4
bt sp, 4
xor edi, ebx
btc bx, ax
neg bh
shl bh, cl
add eax, edi
sub edi, 0xb83456dc
adc di, di
sal bh, cl
add eax, dword [ebp + ecx - 0x2c4]
push 0x55672436
rcr edi, 0xd
mov ebx, dword [ebp - 0x198]
sub di, bx
sbb di, di
not di
add eax, dword [ecx + 0x174b8]
bsf di, bx
jmp loc.00011375

Function at 0x3358c
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x3fce6
add ecx, 4
mov byte [esp], 0x8f
jmp 0x19983
mov dword [esp + 8], 0x153ff
mov dword [esp + 4], 0xeda46b5b
mov byte [esp], 0x76
call fcn.0003c056
jmp 0x231ea
push 0x7d80b31b
dec eax
call fcn.00019cf8

Function at 0x33c03
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0xc]
jne 0x1d108
btc cx, 8
mov eax, dword [ebp - 0xa4]
cmc
rcr di, 4
pushal
mov esi, dword [ebp - 0xa8]
not cx
cmc
mov dword [ebp - 0x198], eax
stc
bts ax, 1
bswap ax
sets ah
mov eax, dword [ebp - 0xa0]
bswap cx
btr di, cx
rcl edi, cl
mov dword [ebp - 0x1ac], eax
rcl di, 0xc
btc edi, edi
movzx cx, bl
mov eax, dword [ebp - 0x9c]
lea edi, [edi*8 - 0xec672fd]
movsx di, al
mov dword [ebp - 0x194], eax
rol al, cl
btc ax, si
cmc
pushal
mov eax, dword [ebp - 0x98]
cmc
cmc
mov dword [ebp - 0x1a8], eax
mov byte [esp + 4], bh
lea ecx, [ebx - 0x70f28159]
mov word [esp + 4], bp
setbe al
mov eax, dword [ebp - 0x94]
xchg cx, di
mov dword [ebp - 0x1a4], eax
lahf
cmc
push dword [esp + 4]
push dword [esp + 0x14]
mov eax, dword [ebp - 0x90]
mov di, word [esp]
mov dword [ebp - 0x19c], eax
push dword [esp + 8]
lahf
stc
mov eax, dword [ebp - 0x8c]
cmc
mov dword [ebp - 0x1b0], eax
not di
bt dx, 5
bswap ax
ror ah, cl
mov dword [ebp - 0x1b4], ebx
pop ebx
cwde
mov ecx, dword [ebp - 0x1a8]
mov word [esp + 4], 0x42a9
bts bx, 8
mov byte [esp], cl
rol bl, cl
mov ebx, dword [ebp - 0x1a4]
setne al
rol di, cl
mov eax, ecx
cmc
rol di, 0xa
ror eax, 0xb
rcr di, 2
btc di, ax
movsx edi, bl
mov edi, ecx
call fcn.0003f549
Function at 0x33d29
Capabilities:
Hash data using murmur3

Disassembly:
push esi
lea esp, [esp + 0x4c]
jne 0x36614
bsf eax, ebx
stc
stc
xor ecx, ecx
cmc
cmp cl, ah
btc ax, bp
aad 0x6e
lea eax, [ebp - 0xf7]
shrd di, bp, 0xd
xor edi, edx
movsx di, al
movzx esi, byte [eax - 1]
clc
xor edi, 0xb553a188
cmc
movzx edi, byte [eax]
bt sp, 9
shl esi, 8
jmp 0x35d50
inc dword [ebp - 0xb8]
test al, ah
test ebp, 0x86f5eecf
pushfd
cmp dword [ebp - 0xb8], 0x40
jmp 0x2229c
bt ax, 0xa
clc
or esi, edi
and di, 0xabb7
lea edi, [ebp*2 + 0x5ec3faf0]
movzx edi, byte [eax + 1]
cmp dl, al
pushal
shl esi, 8
mov byte [esp + 4], ch
test dh, bh
test cx, 0x764a
or esi, edi
or di, 0xc62
rol di, cl
clc
and edi, edi
movzx edi, byte [eax + 2]
cmc
shl esi, 8
stc
or esi, edi
push 0xe0876aae
lea esp, [esp + 0x24]
jo 0x20a91
mov dword [ebp + ecx*4 - 0x2c4], esi
pushal
pushfd
inc ecx
mov byte [esp + 8], bh
bt eax, ecx
add eax, 4
cmc
test dl, dl
cmp al, 0x23
cmp ecx, 0x10
pushfd
lea esp, [esp + 0x28]
jb 0x317ed
sbb si, ax
push 0x40
sbb si, bp
sar si, cl
inc si
pop esi
test ebx, esi
jmp 0x1b945

Function at 0x33d44
Capabilities:
Hash data using murmur3

Disassembly:
imul ecx, ecx, 0x438
cmc
cmp dh, al
clc
pushfd
add ecx, 8
test bp, 0x6c01
stc
test al, ah
cmp dword [ebp + 0x14], ecx
mov byte [esp + 8], al
pushal
call fcn.00036ad6

Function at 0x33ddf
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x30]
jb 0x3ce01
not al
push eax
call fcn.00038dcc
movzx eax, ax
pushal
push ebx
jmp 0x2d260

Function at 0x34185
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp + ecx*4 - 0x2c4], esi
call fcn.0002a07d
cmp bx, 0x8fd5
add esi, dword [eax - 0x38]
call fcn.00021623
jmp 0x314ea

Function at 0x34299
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp + 4], sp
lea esp, [esp + 0x38]
jb 0x34c07
pushfd
xchg cx, ax
call fcn.0001c062
mov dword [eax + 4], esi
call fcn.000351c9
jmp 0x219fb

Function at 0x3453d
Capabilities:
Hash data using murmur3

Disassembly:
shr ecx, 3
pushfd
pushfd
clc
test dl, 0x42
xor esi, ecx
bts cx, 1
mov ecx, dword [eax]
jmp 0x38bfa
cmc
mov word [esp], 0x78e1
cmp sp, 0x3619
xor esi, edi
clc
bsf di, bx
sal edi, 0x13
mov edi, dword [eax]
jmp 0x231d3

Function at 0x34700
Capabilities:
Hash data using murmur3

Disassembly:
stc
clc
rol edi, 0xf
push ebp
rol ecx, 0xd
cmc
clc
xor edi, ecx
movzx cx, bl
inc ecx
clc
neg ch
mov ecx, dword [eax]
add esp, 0x10

Function at 0x348ee
Capabilities:
Hash data using murmur3

Disassembly:
pushal
ror ebx, 7
stc
stc
pushfd
cmp ebx, ebp
xor edi, ebx
inc bl
push dword [esp + 4]
xor edi, ecx
push ebx
mov ecx, edx
ror bl, 6
rcl bx, cl
rcr bx, cl
pop ebx
rol ecx, 0xf
bt dx, di
bswap bx
movsx ebx, cl
bt di, 2
mov ebx, edx
clc
rol ebx, 0xd
clc
cmc
xor ecx, ebx
bt di, di
cmc
bt si, 0xa
shr edx, 0xa
clc
xor ecx, edx
mov byte [esp + 4], 0x73
cmc
add edi, ecx
bt esp, eax
push edx
call fcn.0002e08c
not ecx
call fcn.00013a97
not si
mov esi, dword [esp + 4]
pop ebx
lea ebx, [ebx - 0xe059c6d]
setae bl
mov ebx, dword [esp + 4]
push 0x5330ba83
push 0xeb05bd7e
lea esp, [esp + 0x10]
leave
push edx
mov byte [esp], 0xcf
pushfd
mov word [esp], dx
push dword [esp + 8]
ret 0x14
Function at 0x349af
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [ebp - 0xb8]
mov word [esp + 4], cx
mov byte [esp + 4], cl
jmp 0x2d5a1
push 0x8b69174c
mov al, byte [ebp + eax - 0x18]
mov byte [esp], 0xb9
mov byte [ebp + ecx - 0xf8], al
pushfd
pushal
mov word [esp + 8], dx
push 0xa82efadd
inc dword [ebp - 0xb8]
test bh, 0xee
cmc
cmp dword [ebp - 0xb8], 0x40
pushfd
lea esp, [esp + 0x40]
jne 0x36614
clc
sal si, 8
not al
bswap ax
sub ecx, ecx
aad 0x84
rol ah, 6
shl al, cl
aas
lea eax, [ebp - 0xf7]
call fcn.000312ef
pushfd
mov dword [ebp - 0x28], ebx
lea esi, [edi + 0x2966a17c]
pop esi
pushal
mov dword [esp + 0x1c], 0x18
lea esi, [ecx*2 - 0x779c7196]
bswap si
pushfd
jmp 0x33750
not al
mov edx, 0x200
xchg cx, ax
mov eax, dword [ebp - 0x1a0]
jmp 0x2a954

Function at 0x34ba3
Capabilities:
Hash data using murmur3

Disassembly:
cmp eax, 0x38
push dword [esp + 4]
lea esp, [esp + 0x28]
jae 0x124b0
sar ch, 1
shr dl, 4
call fcn.0001f96c
call fcn.0004026e
lea esp, [esp + 0x34]
call sub.ntoskrnl.exe_memset
das
stc
mov eax, dword [ebp - 0x10]
test si, 0xb60f
clc
movzx cx, al
jmp loc.000133e4

Function at 0x34d64
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, edi
call fcn.00040d43
pushal
pushal
push dword [eax + 4]
pop dword [esp + 0x3c]
mov ax, bp
lea eax, [eax - 0x367be2ee]
lea eax, [esi + 0x22c]
push esi
mov word [esp], bx
mov byte [esp], al
mov dword [esp + 0x3c], eax
jmp 0x1f6a1

Function at 0x34f34
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x14]
je 0x36cb2
pushfd
jmp 0x1eedf

Function at 0x351e9
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 4], 0x529c
xchg dword [esp + 0x54], eax
lea eax, [ebx*8 - 0xb8dbcc1]
mov ah, 0xf6
seta ah
lea eax, [ebp - 0x54]
mov byte [esp], 0xc3
mov dword [esp + 0x50], eax
lea esp, [esp + 0x50]
jp 0x3efdc
push 0x6b0a3099
pushfd
movsd dword es:[edi], dword [esi]
push ebx
lea esp, [esp + 0xc]
call fcn.00027527
dec bh
btr ebx, ecx
inc esi
mov bx, bx
pop esi
bsf ebx, edi
xor eax, eax
call fcn.0003de11
movzx eax, byte [eax + edi]
pushfd
add eax, ebx
shrd bx, bp, cl
shl bh, cl
btc bx, 5
dec bl
xor edx, edx
cmp dh, 0x17
sal bl, cl
sbb bx, sp
movsx bx, al
mov ebx, 0xfff1
cmc
mov byte [esp + 0xc], ch
call fcn.00024646
push dword [ebp + 0x14]
pop dword [esp + 0x28]
push dword [esp + 0x1c]
call fcn.0001c06f
movsd dword es:[edi], dword [esi]
jmp 0x22451

Function at 0x35301
Capabilities:
Hash data using murmur3

Disassembly:
push 0x100deedd
mov dword [eax + 4], edi
pushfd
push ebx
pushfd
mov byte [esp], 0x32
lea esp, [esp + 0x40]
jmp 0x1c202
inc ax
mov dword [ebp - 0x1b4], ebx
pushal
movsx ax, bl
mov eax, dword [ebp - 0x1b4]
pushfd
mov ecx, dword [ebp - 0xb8]
push dword [esp + 0xc]
push 0x8490af8
mov al, byte [ebp + eax - 0x1c4]
mov byte [esp + 4], 0x5c
jmp 0x3ece4
clc
cmp dl, ch
cmp dword [ebp - 0x1b4], 8
mov byte [esp + 4], cl
push dword [esp + 4]
lea esp, [esp + 0x3c]
jb 0x1a1c4
push esp
jmp 0x2ae31
call fcn.000232ad
jmp 0x28456
Function at 0x3539f
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.000369b0
push 0x7376290a
mov byte [esp + 8], 0xaf
mov dword [ebp - 0x19c], edi
neg di
cmc
rol edi, 0xb
or di, 0xf75d
mov edi, 0x100
mov dword [esp + 8], eax
mov dword [ebp - 0x198], esi
shr si, cl
mov dword [ebp - 0x1b0], ebx
cmc
dec esi
lea esi, [ecx + eax]
cmp al, cl
jmp 0x2f7f9

Function at 0x354ae
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 4], 0xcb
mov dword [esp + 4], 0x27e2b
call fcn.00011c38

Function at 0x354c0
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x48]
jb 0x1a1c4
cwde
mov cl, 0x38
mov dword [ebp - 0x1b4], ebx
call fcn.0002bf8c

Function at 0x355ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [ebp + eax - 0x1c4]
call fcn.00033f98
jmp 0x3ddcb
push eax
mov dword [ebp - 0x1a4], edx
bswap dx
mov edx, dword [ebp - 0x1b4]
push esi
jmp 0x12642

Function at 0x3571b
Capabilities:
Hash data using murmur3

Disassembly:
bt bp, bx
jle 0x41065
test al, 0x7a
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x16883
pushal
pushfd
mov word [esp], cx
test eax, 0x800
call fcn.0003da60
dec eax
push ebp
pushal
lea esp, [esp + 0x2c]
jne 0x36cb8
adc al, 0xdd
lea esi, [esp - 0x42c67f6b]
aaa
rol ax, 7
mov esi, dword [edi + 0x14]
aam 0xfa
btr ax, 5
mov eax, dword [esi]
jmp 0x20855
pushal
test ch, 0x40
call fcn.0002b7df

Function at 0x35747
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pushfd
push 0xf54dcc6b
mov dword [ebp - 0x28], eax
mov word [esp], 0x55f4
call fcn.00011882

Function at 0x3582e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
bt ebx, esp
clc
add dword [ebp - 0xfc], ebx
shld ebx, eax, cl
inc ebx
clc
bswap bx
add dword [ebp - 0x118], esi
bsf bx, ax
adc bx, 0x4f9
add dword [ebp - 0x100], eax
sar bh, cl
add dword [ebp - 0x120], edx
pushal
movsx bx, bl
pushfd
mov dword [esp + 0x44], 0
setb bl
movzx bx, cl
lea ebx, [ecx - 0x45ebd2c0]
mov ebx, dword [esp + 0x44]
push edi
lea esp, [esp + 0x4c]
jp 0x3f3dd
adc dword [ebp - 0x11c], ebx
call fcn.00028a49

Function at 0x35a8b
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x48]
jae 0x3a1ad
jb 0x317ed

Function at 0x36436
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 0x10], 0x44
lea esp, [esp + 0x58]
jb 0x3dfd1
bt si, 0xa
mov eax, dword [ebp - 0x198]
pushfd
test cl, 1
pushal
add dword [ebp - 0xa4], eax
not ax
mov eax, dword [ebp - 0x1a8]
clc
add dword [ebp - 0x9c], eax
call fcn.0001ccca

Function at 0x36498
Capabilities:
Hash data using murmur3

Disassembly:
pushal
push dword [eax + 4]
pop dword [esp + 0x20]
setno al
movzx ax, dl
mov eax, edi
pop eax
lea eax, [esi + 0x22c]
call fcn.00025bf0
bt bx, cx
cmp cx, dx
mov byte [esp], bl
push esp
lea esp, [esp + 8]
jae 0x1e5ef
bswap di
movsx di, dl
movzx di, dl
movzx edi, cx
push 0x84742dcd
pushfd
mov dword [esp + 4], edi
jmp 0x29292
Function at 0x36681
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edi, dword [ebp - 0x19c]
clc
cmp cl, dh
and ebx, esi
push edi
xor edi, ebx
and bl, 0x16
mov ebx, dword [ebp - 0x1ac]
push dword [esp + 4]
cmc
test dx, bx
pushfd
add ecx, edi
movzx edi, dl
mov dword [esp], ebx
pop edi
lea edi, [eax*4 - 0x1623267e]
mov edi, dword [ebp - 0x1a8]
push esp
push 0x192b8ac1
lea esp, [esp + 0x40]
jmp fcn.000379fe

Function at 0x374a6
Capabilities:
Hash data using murmur3

Disassembly:
inc dword [ebp - 0x128]
bt dx, di
cmp ax, dx
mov word [esp], 0x82a5
cmp dword [ebp - 0x128], 0x40
jmp 0x382de

Function at 0x37797
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x8333e6b
mov dword [ebp - 0x1a4], edx
bswap dx
movsx dx, al
mov word [esp + 8], dx
pop edx
mov edx, dword [ebp - 0x1b4]
push 0x82458154
jmp 0x34fb9

Function at 0x37ac6
Capabilities:
Hash data using murmur3

Disassembly:
push edx
lea esp, [esp + 0xc]
jae 0x1e5ef
lea edi, [esi - 0x145a0f0]
movzx edi, cx
call fcn.000292c5

Function at 0x37c15
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
bt esp, 5
add eax, 4
cmc
cmp ecx, 0x10
mov byte [esp], al
lea esp, [esp + 0x3c]
jb 0x2fad9
jmp fcn.00012a19

Function at 0x37f50
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 0xc], 0x17b90
call fcn.000296d9
Function at 0x3829a
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x1c743
mov ebx, ecx
stc
cmc
ror ebx, 7
mov word [esp + 4], ax
cmc
xor edx, ebx
test esp, ecx
push 0x7f7a9a49
test al, cl
mov word [esp + 0x20], bx
shr ecx, 3
clc
clc
xor edx, ecx
mov word [esp + 0xc], 0x64ab
add esi, edx
stc
jmp 0x3545d

Function at 0x384cd
Capabilities:
Hash data using murmur3

Disassembly:
cmc
test bx, 0xe5c0
xor esi, dword [ecx]
cmc
stc
jmp 0x335a5

Function at 0x386de
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov byte [esp], al
xor eax, ebp
push 0x5550fc15
pushal
mov dword [ebp - 4], eax
sal eax, cl
shr al, 1
cmp dword [ebp + 0x10], 8
call fcn.000353e4
pushal
lea esp, [esp + 0x24]
jne 0x16883
call fcn.00029f3d
mov dword [esp + 0x24], ecx
pushal
call fcn.0001e99f

Function at 0x38843
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, ecx
setl ch
setns ch
bt ebx, 5
mov ecx, dword [eax]
bt ebp, 0x12
cmc
mov byte [esp], 0xc6
rol edi, 0xf
stc
rol ecx, 0xd
test bp, sp
cmc
test si, 0xe97
xor edi, ecx
ror ecx, 0x10
or cl, 0x4d
pushfd
ror ch, 1
mov ecx, dword [eax]
stc
test al, 0xb1
shr ecx, 0xa
push ebp
mov byte [esp + 8], bl
clc
xor edi, ecx
bt eax, edx
call fcn.0003f0cd
jmp 0x37060

Function at 0x38b83
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 8], ecx
pushal
mov word [esp], dx
pushfd
lea esp, [esp + 0x2c]
jmp 0x1b042

Function at 0x38e65
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 0x10], bh
lea esp, [esp + 0x28]
call sub.ntoskrnl.exe__alldiv
call fcn.00011df2

Function at 0x38e77
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 0x30], ecx
mov word [esp + 8], sp
lea esp, [esp + 0x30]
jmp 0x1b042

Function at 0x39ebf
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x48]
jge 0x3a226
mov dword [eax + 4], esi
jmp 0x3a070
push 0x7b19cfef
push 0xf9547d7a
call fcn.00033c03
jmp 0x21a12

Function at 0x3a45d
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
cmp bl, ch
test al, 0x7a
jmp 0x386f9
jmp 0x1b8ba

Function at 0x3a477
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x48]
jne 0x16883
call fcn.000111b4
stc
test ebp, 0x82205d4c
mov dword [ebp - 0x19c], edi
dec di
or di, di
lea edi, [eax - 0x76378793]
mov edi, 0x100
stc
pushfd
mov dword [ebp - 0x198], esi
xor si, bx
xor si, 0x550
clc
mov dword [ebp - 0x1b0], ebx
add si, 0xd0a3
pop esi
xor si, 0x4677
lea esi, [ecx + eax]
call fcn.00028294
jmp 0x284f2

Function at 0x3a796
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [eax + 4], esi
pushfd
pushal
call fcn.000259f1
Function at 0x3a7a0
Capabilities:
Hash data using murmur3

Disassembly:
sbb al, 0x88
bsr si, dx
movzx cx, al
bsr esi, edx
mov eax, dword [ebp - 0xb8]
lea ecx, [edx - 0x3db4da8e]
shl eax, 3
inc dl
pushal
add dword [ebp - 0xb0], eax
push 0x70eeb32f
lahf
lea eax, [ecx*8 - 0x77fc533d]
pop eax
mov eax, dword [ebp - 0xac]
inc ch
mov dl, byte [ebp - 0xb0]
lea ecx, [edx - 0x3c7bb6b]
bswap esi
mov byte [ebp - 0xb9], dl
inc dh
bswap dx
mov edx, dword [ebp - 0xb0]
bswap cx
pushal
movsx cx, bl
setge cl
mov dword [esp + 0x3c], 0
not ch
lea esp, [esp + 0x3c]
jp 0x28028
jmp loc.00021050
cwde
sub ecx, ecx
sal edx, cl
lea eax, [ebp - 0xf7]
call fcn.00025299
cmc
cmc
clc
shrd edx, esi, 0x10
stc
call fcn.00022bb5
pushfd
mov dword [esp], 0
push 0x367906df
mov word [esp], si
mov dword [esp], esi
push 0xe3493fc2
mov dword [esp], 0x2bb7e
push ebx
pushal
mov dword [esp + 0x20], ebx
mov byte [esp], bl
push dword [esp + 0x20]
ret 0x24
push 0x9a185be3
stc
stc
rol ecx, 0xd
clc
xor edi, ecx
add esp, 4
neg ch
mov ecx, dword [eax]
cmc
cmc
cmc
shr ecx, 0xa
push 0x1b6affa3
xor edi, ecx
mov byte [esp], 0xb6
call fcn.00024680
mov byte [ebp - 0xc0], al
dec si
das
mov byte [ebp - 0xbf], dl
rcl al, cl
xor ax, 0xf10
lea eax, [ebp - 0xf7]
xadd si, dx
movzx edx, byte [eax - 1]
rol si, cl
movzx esi, byte [eax]
call fcn.0002745c
mov dword [ebp - 0x194], eax
btr ax, ax
movsx ax, bl
rcr ah, 4
pushfd
mov eax, dword [ebp - 0x24]
cmc
pushfd
bt ax, 5
mov dword [ebp - 0x1a4], eax
lahf
rol eax, 0x16
mov eax, dword [ebp - 0x1c]
call fcn.0003d95a
push 0x4af7f5dc
mov dword [ebp + ecx*4 - 0x2c4], esi
lea esp, [esp + 0x3c]
jge 0x398b5
push esi
push 0x5d14413
mov byte [esp + 4], dh
inc ecx
pushfd
test bh, 0x2a
bt di, sp
clc
add eax, 4
test edi, 0xb43dd998
bt di, dx
call fcn.00029a43
pushal
lea esp, [esp + 0x20]
jae 0x29cf7
bt edx, edi
clc
push edx
cmp eax, 0x38
pushfd
pushfd
push edx
lea esp, [esp + 0x10]
jae 0x124b0
sbb dx, bx
movsx cx, cl
sar dx, 4
movsx edx, dl
push 0x38
dec cl
bts edx, edi
bsf ecx, ebp
pop edx
shld cx, bp, cl
bsr cx, bp
sub edx, eax
mov cx, 0xd2cd
mov cl, ch
setns cl
jmp 0x2aa23
pushfd
lea esp, [esp + 0x28]
jae 0x1e9b3
bswap cx
shl dx, cl
not dl
mov edx, esi
rcr ch, 2
bswap ecx
sub edx, eax
bswap cx
push edx
call fcn.0003f591
neg esi
lea esi, [ebp - 0x18c19b05]
mov esi, eax
bt bx, bp
jmp 0x233af
pushal
shrd si, bp, 0xa
inc esi
mov dword [esp + 0x1c], 0x40
shr si, 5
push dword [esp]
dec si
bsr si, bx
mov esi, dword [esp + 0x20]
clc
clc
cmp eax, esi
jmp 0x27e59
push edx
movsx cx, dl
mov ch, 0xfb
lea ecx, [ebp + eax - 0xf8]
pushfd
mov dword [esp], 0
call fcn.00037945
push 0x630dff9
mov byte [esp], bl
jmp fcn.00029c2b
xor esi, ecx
clc
setbe cl
ror cl, cl
mov ecx, dword [eax]
clc
rol edi, 0xf
mov byte [esp], 0x75
mov word [esp], di
mov word [esp], bx
lea esp, [esp + 0x54]
jmp 0x24bf5