joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70d8ee
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0070d7b6
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x70da66
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x70da66
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x70da15
jg 0x70d947
test eax, eax
je 0x70da0b
push 1
push 0x1000
call fcn.0070534c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x70d96d
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x70da02
push 0x8000
push ebx
call fcn.00709329
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x70d999
jg 0x70d994
cmp ecx, 0x1000
jb 0x70d999
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00712340
add esp, 0x10
cmp eax, 0xffffffff
je 0x70d9de
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x70d994
jl 0x70d9c5
test ecx, ecx
jne 0x70d986
push dword [ebp - 0xc]
push ebx
call fcn.00709329
push esi
call fcn.007053a9
add esp, 0xc
xor edi, edi
jmp 0x70da77
cmp byte [edi + 0x24], 0
je 0x70d9f5
cmp dword [edi + 0x20], 5
jne 0x70d9f5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x70da00
mov edi, dword [edi + 0x18]
jmp 0x70da02
xor edi, edi
push esi
call fcn.007053a9
pop ecx
jmp 0x70da77
test ecx, ecx
jg 0x70d9d7
jl 0x70da15
test eax, eax
jae 0x70d9d7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00706a02
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x70da38
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x70d9d7
jmp 0x70da6f
push ebx
call fcn.007158c5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x70d9d7
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x70da77
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x70da74
mov edi, dword [edi + 0x18]
jmp 0x70da77
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00706a02
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7110da
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0xefbd50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x71111a
cmp byte [ebx], 0xa
jne 0x71111a
or byte [eax + edi + 0x28], 4
jmp 0x71111f
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x71121d
mov al, byte [edx]
cmp al, 0x1a
je 0x7111ff
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x71114e
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x711173
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x71117d
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x711130
jmp 0x71121d
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x7111fa
cmp dword [ebp - 0xc], 0
je 0x7111fa
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0xefbd50]
test byte [eax + edi + 0x28], 0x48
je 0x7111d4
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x7111bf
mov byte [esi], dl
jmp 0x7111d0
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0xefbd50]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x71121d
cmp byte [ebp - 1], 0xa
jne 0x7111e3
cmp esi, ebx
jne 0x7111e3
mov byte [esi], 0xa
jmp 0x71121c
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00706a02
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x71121d
mov byte [esi], 0xd
jmp 0x71121c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0xefbd50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x711219
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x71121d
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x711226
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0xefbd50]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x711269
cmp word [esi], dx
jne 0x711269
or byte [edi + eax + 0x28], 4
jmp 0x71126e
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x7113c1
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x7113a1
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x7112b0
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x7112e6
cmp eax, edx
jae 0x7112f2
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x711288
jmp 0x7113c1
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x71139d
cmp dword [ebp - 0x14], 0
je 0x71139d
mov eax, dword [ebx*4 + 0xefbd50]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x711375
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x71133e
mov word [esi], cx
jmp 0x711371
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0xefbd50]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0xefbd50]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0xefbd50]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x7113c1
pop ebx
cmp word [ebp - 4], bx
jne 0x711386
cmp esi, dword [ebp + 0xc]
jne 0x711386
mov word [esi], bx
jmp 0x7113be
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00706a02
add esp, 0x10
cmp word [ebp - 4], bx
je 0x7113c1
push 0xd
jmp 0x7113ba
mov ecx, dword [ebx*4 + 0xefbd50]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x7113b8
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x7113c1
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x7133d6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xcc8e94
push 0xcc8e8c
push str.FlsAlloc
push 0x1e
call fcn.00713203
mov esi, eax
add esp, 0x10
test esi, esi
je 0x71340a
push dword [ebp + 8]
mov ecx, esi
call dword [0xcc6820]
call esi
jmp 0x713410
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x713454
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xcc8ea4
push 0xcc8e9c
push str.FlsGetValue
push 0x20
call fcn.00713203
mov esi, eax
add esp, 0x10
test esi, esi
je 0x71348b
push dword [ebp + 8]
mov ecx, esi
call dword [0xcc6820]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x718b9c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00718a0d
Function at 0x71a181
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x71a21e
push ebx
push esi
call fcn.0071a14a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00715b4c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x71a1cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x71a21d
push edi
push eax
call fcn.00705450
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x71a1eb
call fcn.007053a9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x71a21c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00715b4c
add esp, 0x20
test eax, eax
jne 0x71a20a
push edi
call fcn.007053a9
jmp 0x71a212
push ebx
call fcn.007053a9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x71a221
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x71a232
pop esi
ret
push ebx
push edi
push esi
call fcn.0071a14a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00705450
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x71a25a
push ebx
push esi
push edi
call fcn.006f6760
add esp, 0xc
push 0
call fcn.007053a9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x71a9a6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0071a4cd

Function at 0x71f46a
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
cmp byte [ecx], al
je 0x71f484
cmp eax, dword [ebp + 0xc]
je 0x71f484
inc eax
mov dword [0xf0f8fa], ebx
neg esi
Function at 0x71fe19
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.005647e3
not ecx
add ecx, ebp
ror esi, 3
add ebx, edi
mov edi, 0xfae5f70e
add esi, dword [0xf0fe4e]
or dword [0xf0f8c1], 0xbd43ecd6
mov ebp, 0xf75b0d81
lock add byte [eax], ah
loope 0x71fe15
ja 0x71fe91
call fcn.005f21a8
add eax, dword [0xf0fca3]
sub esi, edx
call fcn.00612ef5
not esi
add edx, 0xbfb2d8d5
xchg edx, esi
add ecx, ebx
or eax, dword [0xf0fe6d]
call fcn.004a6c84
sub ecx, ebx
xchg edx, esi
sub edx, 0xbfb2d8d5
not esi
call fcn.004ff715
add esi, edx
call fcn.004f9cca
inc edx
and dword [0xf0fa6b], 0xc0e7dcd3
and edi, 0x46b935c5
not edi
sub eax, 0x459d347c
mov dword [0xf0fa69], 0x53165a14
xor ecx, dword [0xf0fe04]
sub edi, ecx
mov dword [0xf0fa46], ecx
xor ecx, 0x3d7ed67
xchg ecx, edx
xor edi, dword [0xf0ff27]
add ecx, 0xf29b7cc4
not esi
xor dword [0xf0f9bf], eax
ror ebx, 0xf
rol ebx, 0xf
add dword [0xf0f745], esi
not esi
sub ecx, 0xf29b7cc4
xchg ecx, edx
xor ecx, 0x3d7ed67
or dword [0xf0f706], ecx
add edi, ecx
or dword [0xf0f91a], 0x703c1541
add eax, 0x459d347c
not edi
xor edi, 0x42c4356f
xchg edi, esi
dec edx
sub ebx, eax
call fcn.0052a862
xor dword [0xf0f78b], 0x3f366e11
inc ecx
call fcn.006a4230
ror eax, 7
sub dword [0xf0f89f], edi
call fcn.0042f73f
add edx, esp
call fcn.00513e71
sub edx, dword [0xf0fe74]
call fcn.00583d64
sub edx, esp
call fcn.0068d602
rol eax, 7
call fcn.00461e29
dec ecx
call fcn.0051074a
add ebx, eax
inc edx
xchg edi, esi
push edi
xor esi, dword [0xf0ff77]
xor edi, ecx
xchg ebx, edx
add ebx, dword [0xf0fed3]
not edx
sub eax, ebx
call fcn.00626101
xchg esi, eax
xor esi, dword [0xf0ff98]
not esi
add ecx, dword [0xf0fcc8]
inc eax
sub edi, dword [0xf0fe54]
xor ecx, 0xb7809fdf
sub edi, dword [0xf0fe2b]
call fcn.005acc69
xor ecx, 0xb7809fdf
dec eax
not esi
xchg esi, eax
call fcn.005e2749
add eax, ebx
not edx
xchg ebx, edx
xor edi, ecx
push esp
xchg eax, edx
sub edx, dword [0xf0fda5]
sub edi, 0xaedc2869
add edi, 0x473183a4
invalid
Function at 0x71fe3b
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.005647e3
not ecx
add ecx, ebp
ror esi, 3
add ebx, edi
mov edi, 0xfae5f70e
add esi, dword [0xf0fe4e]
or dword [0xf0f8c1], 0xbd43ecd6
mov ebp, 0xf75b0d81
lock add byte [eax], ah
loope 0x71fe15
ja 0x71fe91
call fcn.005f21a8
add eax, dword [0xf0fca3]
sub esi, edx
call fcn.00612ef5
not esi
add edx, 0xbfb2d8d5
xchg edx, esi
add ecx, ebx
or eax, dword [0xf0fe6d]
call fcn.004a6c84
sub ecx, ebx
xchg edx, esi
sub edx, 0xbfb2d8d5
not esi
call fcn.004ff715
add esi, edx
call fcn.004f9cca
inc edx
and dword [0xf0fa6b], 0xc0e7dcd3
and edi, 0x46b935c5
not edi
sub eax, 0x459d347c
mov dword [0xf0fa69], 0x53165a14
xor ecx, dword [0xf0fe04]
sub edi, ecx
mov dword [0xf0fa46], ecx
xor ecx, 0x3d7ed67
xchg ecx, edx
xor edi, dword [0xf0ff27]
add ecx, 0xf29b7cc4
not esi
xor dword [0xf0f9bf], eax
ror ebx, 0xf
rol ebx, 0xf
add dword [0xf0f745], esi
not esi
sub ecx, 0xf29b7cc4
xchg ecx, edx
xor ecx, 0x3d7ed67
or dword [0xf0f706], ecx
add edi, ecx
or dword [0xf0f91a], 0x703c1541
add eax, 0x459d347c
not edi
xor edi, 0x42c4356f
xchg edi, esi
dec edx
sub ebx, eax
call fcn.0052a862
xor dword [0xf0f78b], 0x3f366e11
inc ecx
call fcn.006a4230
ror eax, 7
sub dword [0xf0f89f], edi
call fcn.0042f73f
add edx, esp
call fcn.00513e71
sub edx, dword [0xf0fe74]
call fcn.00583d64
sub edx, esp
call fcn.0068d602
rol eax, 7
call fcn.00461e29
dec ecx
call fcn.0051074a
add ebx, eax
inc edx
xchg edi, esi
push edi
xor esi, dword [0xf0ff77]
xor edi, ecx
xchg ebx, edx
add ebx, dword [0xf0fed3]
not edx
sub eax, ebx
call fcn.00626101
xchg esi, eax
xor esi, dword [0xf0ff98]
not esi
add ecx, dword [0xf0fcc8]
inc eax
sub edi, dword [0xf0fe54]
xor ecx, 0xb7809fdf
sub edi, dword [0xf0fe2b]
call fcn.005acc69
xor ecx, 0xb7809fdf
dec eax
not esi
xchg esi, eax
call fcn.005e2749
add eax, ebx
not edx
xchg ebx, edx
xor edi, ecx
push esp
xchg eax, edx
sub edx, dword [0xf0fda5]
sub edi, 0xaedc2869
add edi, 0x473183a4
invalid

Function at 0x7202aa
Capabilities:
Hash data using murmur3

Disassembly:
push edi
salc
add ebx, dword [0xf0fbd6]
sub ecx, dword [0xf0fc3a]
rol edi, 0xf
sub eax, esp
sub dword [0xf0fa0b], edi
call fcn.006b61fb
add dword [0xf0fae1], edi
add eax, esp
ror edi, 0xf
not esi
call fcn.004f9a23
xor ecx, eax

Function at 0x7202dd
Capabilities:
Hash data using murmur3

Disassembly:
xor ebx, 0xa404a827
call fcn.006a79a5
xchg edx, eax
xor ebx, 0xdfa369ec
or edx, 0x11b2b1eb
add esi, dword [0xf0fed8]
add edi, dword [0xf0fce4]
xor dword [0xf0f83f], ebx
add edi, esi
xor eax, 0x985a0b35
call fcn.005f6d0a
rol ebx, 0x1d
sub ecx, dword [0xf0fe89]
ror ecx, 0x1b
dec edx
add edx, eax
dec edi
xor dword [0xf0f756], ecx
sub edx, eax
or dword [0xf0f875], eax
or dword [0xf0fb52], edx
call fcn.0069cb77
add dword [0xf0f96a], eax
add edx, eax
mov dword [0xf0f8d4], edx
inc edi
sub edx, eax
inc edx
rol ecx, 0x1b
ror ebx, 0x1d
call fcn.005e5155
xor eax, 0x985a0b35
xor eax, 0x2b985a0b
dec byte [ecx]
adc eax, 0xf0f7bd
xor edx, 0xdcd89793
rol edi, 0xc
inc eax
not esi
xor ecx, 0xff6e0ab
call fcn.0060b616
neg edi
call fcn.004e0841
sub edx, 0x805b8fe8
inc edi
ror ecx, 3
sub edx, eax
call fcn.0059eeab
Function at 0x72035d
Capabilities:
Hash data using murmur3

Disassembly:
xor ebx, 0xa404a827
call fcn.006a79a5
xchg edx, eax
xor ebx, 0xdfa369ec
or edx, 0x11b2b1eb
add esi, dword [0xf0fed8]
add edi, dword [0xf0fce4]
xor dword [0xf0f83f], ebx
add edi, esi
xor eax, 0x985a0b35
call fcn.005f6d0a
rol ebx, 0x1d
sub ecx, dword [0xf0fe89]
ror ecx, 0x1b
dec edx
add edx, eax
dec edi
xor dword [0xf0f756], ecx
sub edx, eax
or dword [0xf0f875], eax
or dword [0xf0fb52], edx
call fcn.0069cb77
add dword [0xf0f96a], eax
add edx, eax
mov dword [0xf0f8d4], edx
inc edi
sub edx, eax
inc edx
rol ecx, 0x1b
ror ebx, 0x1d
call fcn.005e5155
xor eax, 0x985a0b35
xor eax, 0x2b985a0b
dec byte [ecx]
adc eax, 0xf0f7bd
xor edx, 0xdcd89793
rol edi, 0xc
inc eax
not esi
xor ecx, 0xff6e0ab
call fcn.0060b616
neg edi
call fcn.004e0841
sub edx, 0x805b8fe8
inc edi
ror ecx, 3
sub edx, eax
call fcn.0059eeab

Function at 0x720398
Capabilities:
Hash data using murmur3

Disassembly:
not ebx
xor edx, dword [0xf0fd3e]
or dword [0xf0faf3], edi
or ebx, dword [0xf0ff90]
dec edx
sub eax, dword [0xf0fcf7]
mov dword [0xf0fa94], ebx
mov dword [0xf0f8ba], edx
sub edi, ebx
sub dword [0xf0fa21], esi
add edi, ebx
and dword [0xf0fa6d], edx
or dword [0xf0f7f8], eax
inc edx
or dword [0xf0f8d9], ecx
not ebx
call fcn.005556e2
add edx, eax
rol ecx, 3
dec edi
add edx, 0x805b8fe8
invalid
push ds

Function at 0x720456
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx + 0x2b5ca93f], ch
ffreep st(1)
ret 0xe812

Function at 0x7204c8
Capabilities:
Hash data using murmur3

Disassembly:
and edx, 0x57a85eb2
ror edi, 9
inc edi
call fcn.0049aaa4
inc eax
dec ecx
xor edi, 0xaefb927e
not eax
sub ecx, 0x7c8516e8
add dword [0xf0fa51], 0xaa6d2e58
dec ebx
sub dword [0xf0f7b0], eax
rol ebx, 0x10
call fcn.0048a5ba
add eax, 0x63cb6798
xor esi, ecx
add dword [0xf0f825], eax
call fcn.0047aa9b

Function at 0x720513
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00408629
sub dword [0xf0f980], ecx
xor esi, ecx
sub eax, 0x63cb6798
call fcn.006b4760
ror ebx, 0x10
inc ebx
add ecx, 0x7c8516e8
not eax
xor edi, 0xaefb927e
inc ecx
dec eax
call fcn.005f61cc
dec edi
rol edi, 9
add edx, 0x2dcc1363
sub ecx, 0x5f165a4f
rol ebx, 9
or eax, dword [0xf0fec2]
add esi, eax
xor edx, esi
salc
sub ecx, dword [0xf0fe84]
xor edi, 0x6e23441b
sub dword [0xf0f821], edi
xor edx, 0x6f0e0b1b
and dword [0xf0fb2f], ecx
call fcn.005b449a
call fcn.006222df
sub dword [0xf0fa2b], esi
xor edx, 0x6f0e0b1b
and dword [0xf0fb22], eax
xor edi, 0x6e23441b
xor edx, esi
sub esi, eax
ror ebx, 9
add ecx, 0x5f165a4f
push edx
Function at 0x720560
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00408629
sub dword [0xf0f980], ecx
xor esi, ecx
sub eax, 0x63cb6798
call fcn.006b4760
ror ebx, 0x10
inc ebx
add ecx, 0x7c8516e8
not eax
xor edi, 0xaefb927e
inc ecx
dec eax
call fcn.005f61cc
dec edi
rol edi, 9
add edx, 0x2dcc1363
sub ecx, 0x5f165a4f
rol ebx, 9
or eax, dword [0xf0fec2]
add esi, eax
xor edx, esi
salc
sub ecx, dword [0xf0fe84]
xor edi, 0x6e23441b
sub dword [0xf0f821], edi
xor edx, 0x6f0e0b1b
and dword [0xf0fb2f], ecx
call fcn.005b449a
call fcn.006222df
sub dword [0xf0fa2b], esi
xor edx, 0x6f0e0b1b
and dword [0xf0fb22], eax
xor edi, 0x6e23441b
xor edx, esi
sub esi, eax
ror ebx, 9
add ecx, 0x5f165a4f
push edx

Function at 0x7205af
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, dword [0xf0feca]
add edx, ebx
call fcn.005bf933
inc eax
add ebx, esp
add dword [0xf0f90f], esi
sub ecx, esp
inc esi
dec edi
add edx, ebp
sub ebx, dword [0xf0fefa]
sub esi, ecx
not edi
xor esi, esp
call fcn.005b3b1e
xor edx, ebx
or ecx, dword [0xf0fe04]
call fcn.004562b8
call fcn.005d8f61
xor edx, ebx
xor esi, esp
not edi
add esi, ecx
sub edx, ebp
inc edi
dec esi
add ecx, esp
add dword [0xf0f828], eax
sub ebx, esp
dec eax
sub edx, ebx
mov ecx, 0xa1b0017
dec ebx
xor dword [0xf0f76b], eax
rol ecx, 1
call fcn.0056e62a
sub esi, dword [0xf0fc92]
xchg ebx, edx
rol edi, 0x14
neg edi
add dword [0xf0f706], 0x214eda39
xor esi, ebp
mov dword [0xf0f76c], ebx
and dword [0xf0fb1c], edx
xor esi, ebp
neg edi
ror edi, 0x14
xchg ebx, edx
call fcn.00622fdd
ror ecx, 1
inc ebx
and ecx, 0xcb2c20b5
sub edi, dword [0xf0ff4f]
xor edi, esp
ror eax, 0x1a
xchg edx, eax
dec edx
xchg edi, esi
add dword [0xf0f79c], edi
call fcn.00521cb8
push ss
loopne 0x720672
Function at 0x720c40
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, edi
rol eax, 0x10
dec edi
xor edx, ecx
rol eax, 0x19
neg ecx
or dword [0xf0fb42], edi
sub dword [0xf0f7b4], esi
xor ebx, 0x5933bf3a
call fcn.004f300e
xor ebx, 0x5933bf3a
sub dword [0xf0fabd], edi
or dword [0xf0fb50], ecx
neg ecx
ror eax, 0x19
xor edx, ecx
inc edi
ror eax, 0x10
xor eax, edi
neg esi
push 0x4fe50
xchg eax, esi
and dword [0xf0f9b2], ecx
add dword [0xf0f8df], edx
sub dword [0xf0fb16], ecx
call fcn.00570445
or eax, dword [0xf0fbd5]
call fcn.004cd6d2
sub eax, ecx
call fcn.00476327

Function at 0x720cb5
Capabilities:
Hash data using murmur3

Disassembly:
xor dword [0xf0fa25], ecx
add edi, 0x27c3fc24
neg eax
add eax, dword [0xf0fcfd]
or dword [0xf0f7e1], ecx
xor dword [0xf0f702], edx
neg eax
sub edi, 0x27c3fc24
or dword [0xf0f998], eax
call fcn.006586f0
add eax, ecx
call fcn.0062123d
call fcn.00478666
and dword [0xf0f7d9], edx
xchg eax, esi
mov edi, 0x6e22e4ee
call fcn.0060a2ff
xor ebx, 0x7f0589e4
sub eax, dword [0xf0ff8f]
xor dword [0xf0f7e5], edi
or dword [0xf0fa82], edx
xor ecx, esp
xor eax, ebp
inc esi
sub ebx, dword [0xf0fe90]
xchg ebx, edx
xor esi, 0xde400611
xor edi, eax
xor eax, dword [0xf0fc27]
neg esi
add ecx, edx
neg esi
ror edi, 0x1f
sub edx, esp
add edx, esp
rol edi, 0x1f
neg esi
sub ecx, edx
neg esi
xor edi, eax
xor esi, 0xde400611
xchg ebx, edx
dec esi
xor eax, ebp
xor ecx, esp
mov dword [0xf0f70e], ebx
add dword [0xf0f8aa], ecx
xor ebx, 0x7f0589e4
sub edi, 0xfdf9c019
or dword [0xf0f800], edi
dec eax
xor ebx, 0xda2b4a2a
sub ebx, edi
not ecx
or ebx, dword [0xf0fbc2]
rol edx, 0x17
sub dword [0xf0f73e], ecx
inc eax
dec edx
sub edx, 0xa55e9c1b
add edx, dword [0xf0fcbd]
sub ecx, esp
not esi
xchg ebx, esi
add esi, 0x1292b97
xchg esi, edx
mov dword [0xf0fb0e], edi
call fcn.0042077b
call fcn.0060d053
xchg esi, edx
sub esi, 0x1292b97
xchg ebx, esi
not esi
add ecx, esp
add edx, 0xa55e9c1b
inc edx
dec eax
xor dword [0xf0fb25], ebx
ror edx, 0x17
not ecx
add ebx, edi
xor ebx, 0xda2b4a2a
inc eax
xor dword [0xf0fa1a], ecx
xor edi, 0x702924d5
mov dword [0xf0fb27], esi
add ecx, dword [0xf0fe5a]
sub eax, dword [0xf0feb3]
not edx
sub dword [0xf0fa6c], esi
sub eax, edi
dec ecx
add ebx, dword [0xf0ff4b]
not ecx
rol edi, 1
mov dword [0xf0fb4f], 0xb9b43e64
neg edi
xor ebx, dword [0xf0fc9e]
xor edi, edx
ror edx, 6
sub ebx, 0x2c0c574e
call fcn.0042e02f
add ebx, 0x2c0c574e
rol edx, 6
xor edi, edx
neg edi
ror edi, 1
iretd
add edi, esi
rol dword [ecx + 3], 1
invalid
and dword [0xf0f97d], edi
not edx
xor dword [0xf0f976], edi
push edi
add eax, esp
add dword [0xf0f730], eax
not edi
xor eax, dword [0xf0fbbc]
sub dword [0xf0f7b3], ebx
call fcn.004cfdb7
mov dword [0xf0f973], eax
xchg ebx, eax
not eax
add esi, edx
xor dword [0xf0f9be], esi
add ebx, dword [0xf0fdaa]
or dword [0xf0fa41], edx
neg ecx
xor eax, edi
sub eax, 0x752935de
call fcn.005994b9
add eax, 0x752935de
fidiv word [0xc7337529]
neg ecx
sub dword [0xf0f90e], edx
sub esi, edx
not eax
xchg ebx, eax
add dword [0xf0f987], eax
add eax, 0xf0f987
not edi
sub eax, esp
call eax
or ecx, dword [0xf0fbc7]
sub eax, 0xe00b25d7