joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105a553
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x105a602
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x105a601
push 0x100280c
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
test eax, eax
jl 0x105a601
and dword [ebp - 0x214], ebx
and dword [ebp - 0x210], ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
invalid
sti

Function at 0x105a619
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x100a610
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105a6fd
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0x100a5d4
push dword [ebp - 0x420]
xor esi, esi
inc esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105a6f0
cmp dword [ebp - 0x424], esi
jne 0x105a6f0
push esi
push 0x100a5c4
lea eax, [ebp - 0x41c]
push eax
push 0x100a5ac
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.0103592d
add esp, 0x18
test eax, eax
jl 0x105a6ea
lea eax, [ebp - 0x210]
push eax
call fcn.010561eb
test eax, eax
je 0x105a6ea
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, 0x10
jl 0x105a6a3
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01047480
leave
ret
Function at 0x105dfe6
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x730
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x724], esi
call fcn.0105d268
lea eax, [ebp - 0x724]
push eax
push 0x20119
push esi
push 0x100bb40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x105e214
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x730], 0x80
mov dword [ebp - 0x728], esi
mov dword [ebp - 0x72c], esi
mov ebx, 0x208
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x728]
push dword [ebp - 0x724]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x105e206
inc dword [ebp - 0x728]
lea eax, [ebp - 0x72c]
push eax
push 0x20119
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x724]
mov dword [ebp - 0x730], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x105e206
lea eax, [ebp - 0x104]
push eax
push 0x100bb14
push 4
call fcn.01055c8a
add esp, 0xc
push ebx
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.0105d64a
cmp eax, esi
jl 0x105e1e5
push ebx
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x720], esi
call fcn.0105d8b6
test eax, eax
je 0x105e1d7
lea eax, [ebp - 0x104]
push eax
push 0x100bab0
lea eax, [ebp - 0x71c]
push ebx
push eax
call fcn.01035968
add esp, 0x10
push esi
lea eax, [ebp - 0x720]
push eax
push esi
push 0x20106
push esi
push esi
push esi
lea eax, [ebp - 0x71c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x105e1f5
lea eax, [ebp - 0x30c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x105e160
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x30c]
push eax
push 1
push esi
push 0x100ba98
push dword [ebp - 0x720]
call edi
lea eax, [ebp - 0x514]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x105e193
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x514]
push eax
push 1
push esi
push 0x100ba74
push dword [ebp - 0x720]
call edi
push dword [ebp - 0x720]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100ba60
push 4
call fcn.01055c50
jmp 0x105e1f5
lea eax, [ebp - 0x30c]
push eax
push 0x100ba38
jmp 0x105e1eb
push eax
push 0x100ba18
push 2
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x72c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x105e051
push dword [ebp - 0x724]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01047480
leave
Function at 0x10660b8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1072ca8]
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x38], ecx
cmp eax, 0xffffffff
je 0x10660fc
cmp eax, ebx
je 0x106627a
cmp ecx, ebx
je 0x106627a
mov dx, word [0x1074c50]
mov word [ecx], dx
jmp 0x106627a
push esi
push edi
mov dword [0x1072ca8], ebx
call fcn.01066067
xor esi, esi
inc esi
mov word [0x1074c50], ax
cmp ax, bx
je 0x1066143
push 0x10
lea ecx, [ebp - 0x30]
push ecx
movzx eax, ax
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x106620e
test dword [ebp - 0x22], 0x800
je 0x106620e
jmp 0x1066208
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x106620e
xor eax, eax
mov byte [ebp - 0x10], bl
lea edi, [ebp - 0xf]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push 0x100e02c
push 0x80000001
mov dword [ebp - 0x3c], 0xc
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x106620e
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x10]
lea edx, [ebp - 0x10]
xor eax, eax
jmp 0x10661f0
shl eax, 4
cmp cl, 0x30
jl 0x10661c9
cmp cl, 0x39
jg 0x10661c9
movsx ecx, cl
lea eax, [eax + ecx - 0x30]
jmp 0x10661ed
cmp cl, 0x41
jl 0x10661dc
cmp cl, 0x46
jg 0x10661dc
movsx ecx, cl
lea eax, [eax + ecx - 0x37]
jmp 0x10661ed
cmp cl, 0x61
jl 0x10661ed
cmp cl, 0x66
jg 0x10661ed
movsx ecx, cl
lea eax, [eax + ecx - 0x57]
inc edx
mov cl, byte [edx]
cmp cl, bl
jne 0x10661b3
and eax, 0x3ff
cmp eax, esi
je 0x1066202
cmp eax, 0xd
jne 0x106620e
mov word [0x1074c50], ax
mov dword [0x1072ca8], esi
mov eax, dword [0x1072ca8]
invalid

Function at 0x106628e
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 4]
push eax
mov ebx, 0x20006
push ebx
push 0
push 0x100e1e0
mov edi, 0x80000002
push edi
call esi
test eax, eax
jne 0x10662d5
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x100e170
push edi
call esi
test eax, eax
jne 0x10662ff
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0x100e0f8
push edi
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x106632c
push 0x1004b3c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
Function at 0x10663d5
Capabilities:
Enumerate devices by category

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1072c98]
cmp eax, 0x1072c98
je 0x1066406
test byte [eax + 0x3c], 2
je 0x1066406
cmp byte [eax + 0x39], 7
jb 0x1066406
push 0x100e0e4
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0105e5ce
and dword [ebp - 8], 0
push esi
lea eax, [ebp - 8]
push eax
push 0x102ed4c
push 1
push 0
push 0x1010438
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
mov eax, dword [ebp - 8]
test esi, esi
jl 0x10664a4
and dword [ebp - 4], 0
mov ecx, dword [eax]
push 0
lea edx, [ebp - 4]
push edx
push 0x1010448
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jl 0x1066494
mov eax, dword [ebp - 4]
cmp esi, 1
jne 0x106646d
test eax, eax
je 0x1066459
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1066466
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80004005
jmp 0x10664b0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jl 0x1066494
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.01066333
mov esi, eax
test esi, esi
jl 0x106648f
cmp esi, 1
jne 0x1066494
mov esi, 0x80004002
mov eax, dword [ebp - 4]
test eax, eax
je 0x10664a1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10664ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
pop esi
leave
ret 4

Function at 0x1066856
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push esi
mov esi, ecx
and dword [esi + 4], 0
and dword [esi + 8], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x1010a90
call fcn.0106d6aa
lea ecx, [esi + 0x18]
call fcn.0106d6aa
and dword [esi + 0x24], 0
or dword [esi + 0x28], 0xffffffff
and dword [esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x30], eax
mov eax, esi
push esi
cmp esi, eax
jbe 0x106689b
or edx, dword [0x1072ea3]
or ebx, 0x842458ea
cmp dword [0x10739f4], 0x452d2e32
jle 0x10668af
xchg esi, eax
mov esi, esi
ror edi, 0x14
inc esi
and eax, ebx
add ecx, 0x16d69a62
mov ebx, eax
not edx
or ebx, edx
and ebx, 0x86dd25e4
and ecx, 0x13147be3
mov edx, ebx
add ecx, 0x7caa757d
call fcn.0106860d
cmp dword [0x1072c9b], edi
jnp 0x10668e7
rol ecx, 0x1e
mov ecx, 0x4a0993e3
call fcn.010413e7
cmp esi, 0x959577c2
jnp 0x10668ff
or eax, 0xde85c607
ror edi, 0x15
add dword [0x107594d], esi
ror edx, 0x1d
neg esi
not esi
add edx, eax
not ebx
shl ebx, 9
shr edx, 0x1a
neg ebx
xor edi, esp
call fcn.010413e7
dec eax
not eax
mov eax, edi
dec ecx
jne 0x10668ec
mov ecx, 0x4e9e1ff5
Function at 0x1066939
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
ror edi, 1
or esi, eax
rol edx, 0x12
mov edx, dword [0x1072091]
adc eax, 0x1072091
adc eax, 0x1072091
mov dword [0x107576e], 0x1e151065
rol eax, 6
dec eax
and eax, dword [0x107295d]
neg esi
call fcn.0106f733
cmp esi, 0xefe06ad7
jns 0x1066962
dec edx
mov edx, 0x13287c8a
xor edi, 0x28554c54
or ebx, edi
inc edi
or edx, 0xf3231656
dec ecx
jne 0x1066930
sub edi, edi
shr edx, 0x19
shl edx, 0x1b
mov ecx, dword [0x1073740]
shl edi, 0xe
mov esi, 0x24bc5d22
call fcn.0101f354
add eax, ecx
mov edi, 0x9a127fa0
xchg esi, eax
xor eax, edx
not ebx
call fcn.01053050
rol ecx, 0xf
sub edx, dword [0x1075c38]
sub dword [0x10759aa], 0x97764817
xor ebx, 0x30cdb8f4
inc ebx
dec ebx
xor dword [0x1075a4a], edx
or ecx, dword [0x1075ccf]
xor esi, dword [0x1075f86]
not esi
dec esi
or ebx, dword [0x1075c59]
inc esi
not esi
or dword [0x107586f], ecx
inc ebx
dec ebx
xor ebx, 0x30cdb8f4
sub dword [0x10759bd], 0xc2f1e6d7
ror ecx, 0xf
not ebx
xor eax, edx
xchg esi, eax
add edi, 0xb980dd2c
dec eax
call fcn.0101c315
ror ebx, 0xf
xor edi, dword [0x1075c04]
not esi
dec edi
add edx, dword [0x1075c83]
rol edx, 0xd
call fcn.01060423
xor ecx, esi
call fcn.01010495
sub dword [0x10759ac], esi
xor ecx, 0x9a9790fb
ror edx, 0x1d
sub ecx, ebx
call fcn.0101c315
call fcn.0102ec01
add ecx, ebx
rol edx, 0x1d
xor ecx, 0x9a9790fb
or dword [0x1075a9b], eax
xor ecx, esi
call fcn.0104c150
ror edx, 0xd
inc edi
not esi
rol ebx, 0xf
inc eax
sub edi, 0x53935ccc
neg edx
xor esi, ebp
xor esi, 0xa9b92929
neg edx
rol edi, 0x13
xor eax, ecx
inc esi
rol eax, 0x16
neg esi
call fcn.0100c08c
call fcn.0101c315
neg esi
ror eax, 0x16
dec esi
xor eax, ecx
ror edi, 0x13
neg edx
xor esi, 0xa9b92929
xor esi, ebp
Function at 0x1066ffd
Capabilities:
Hash data using murmur3

Disassembly:
sub eax, ebx
or eax, dword [0x1075c0c]
add eax, ebx
neg esi
dec eax
dec edx
sub eax, ebx
add ecx, esi
xor dword [0x10758f6], ebx
mov edi, 0xcdad01d6
dec ecx
add edx, dword [0x1075d41]
mov dword [0x1075a81], edi
sub eax, 0xd5c3d9b4
neg edi
or dword [0x10757d6], edi
call fcn.01061f50
rol eax, 0x1a
or edi, dword [0x1075f20]
add dword [ebx], esi
add eax, 0x1075ae9
not esi
xor edx, edi
xor edx, dword [0x1075d86]
xor dword [0x1075a66], ecx
ror edi, 0x12
inc edx
xchg edi, esi
xchg edi, esi
dec edx
rol edi, 0x12
xor edx, edi
not esi
ror eax, 0x1a
call fcn.01005662
neg edi
add eax, 0xd5c3d9b4
or dword [0x1075a24], edx
inc ecx

Function at 0x1067080
Capabilities:
Hash data using murmur3

Disassembly:
add edi, 0xef705d2b
xor ebx, esp
call fcn.01010495
or edx, dword [0x1075cde]
sub edi, dword [0x1075c1f]
xor dword [0x1075765], eax
xor edx, ecx
sub edi, dword [0x1075bc5]
dec ecx
or dword [0x1075a90], ecx
sub dword [0x1075a4f], edi
call fcn.0105e220
call fcn.010380a4
std
jmp [ecx]
add eax, 0x10755e7
sub dword [0x1075770], ebx
inc ecx
xor edx, ecx
or dword [0x10758dc], ecx
call fcn.0102ec01
xor ebx, esp
add edi, 0x4347a16a
xor edx, eax
call fcn.0101c315
add ecx, 0xdff36576
not esi
and dword [0x1075784], ecx
ror ebx, 0x1f
dec ecx
sub dword [0x1075a7d], eax
sub edi, dword [0x1075b30]
sub dword [0x107579b], ebx
dec ebx
xor edi, ecx
stc

Function at 0x106710d
Capabilities:
Hash data using murmur3

Disassembly:
stc
or edx, dword [0x1075f2c]
xor edi, ecx
inc ebx
xor dword [0x10755ac], eax
or dword [0x1075a9e], ecx
inc ecx
rol ebx, 0x1f
add dword [0x10757a9], esi
not esi
sub ecx, 0xdff36576
xor edx, eax
push edi
or eax, dword [0x1075c4e]
dec edx
not esi
xor esi, dword [0x1075dee]
xor ecx, 0x2ae49296

Function at 0x106714d
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, 0x631373e5
rol edi, 8
neg edx
call fcn.0103a738
sub eax, 0xa77ef32
call fcn.01041a9c
or esi, dword [0x1075b49]
or dword [0x10755ae], edi
add ecx, dword [0x1075c37]
mov dword [0x1075a4c], edi
inc edx
not esi
salc
add dword [0x10756d4], esi
add edi, dword [0x1075c28]
or dword [0x10756c6], ecx
xchg ecx, esi
xchg ecx, esi
xor dword [0x1075605], ebx
not esi
dec edx
xor dword [0x10757fb], esi
or dword [0x107584a], edi
add eax, 0xa77ef32
call fcn.0102ec81
neg edx
ror edi, 8
xor ecx, 0x631373e5
xor ecx, 0x2ae49296
not esi
inc edx
push esp
rol eax, 0x16
not eax
call fcn.0100c08c
and dword [0x10757aa], eax
xor eax, dword [0x1075e9c]
inc ebx
call fcn.01005662
inc edi
ror esi, 5
mov dword [0x10756fe], 0xfa37866b
rol esi, 0x14
sub edx, dword [0x1075b65]
not ebx
call fcn.01037f55
neg eax
dec edi
xor dword [0x10756d5], esi
aad 0x56
pop es
add dword [edi + 0x29f387f3], eax
cmp eax, 0x10758cc
inc edi
neg eax
not ebx
ror esi, 0x14
rol esi, 5
dec edi
dec ebx
call fcn.01032ce2
not eax
ror eax, 0x16
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, edi
call fcn.010365cb
not ebx
xor dword [0x10757e5], edi
add esi, dword [0x1075e30]
ror eax, 0x1d
xor ecx, dword [0x1075e94]
call fcn.0100c08c
sub edx, ecx
mov dword [0x10758d7], 0x24cf186c
call fcn.0101c315
xor edi, dword [0x1075bcc]
inc eax
call fcn.01010495
Function at 0x106720d
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, 0x631373e5
rol edi, 8
neg edx
call fcn.0103a738
sub eax, 0xa77ef32
call fcn.01041a9c
or esi, dword [0x1075b49]
or dword [0x10755ae], edi
add ecx, dword [0x1075c37]
mov dword [0x1075a4c], edi
inc edx
not esi
salc
add dword [0x10756d4], esi
add edi, dword [0x1075c28]
or dword [0x10756c6], ecx
xchg ecx, esi
xchg ecx, esi
xor dword [0x1075605], ebx
not esi
dec edx
xor dword [0x10757fb], esi
or dword [0x107584a], edi
add eax, 0xa77ef32
call fcn.0102ec81
neg edx
ror edi, 8
xor ecx, 0x631373e5
xor ecx, 0x2ae49296
not esi
inc edx
push esp
rol eax, 0x16
not eax
call fcn.0100c08c
and dword [0x10757aa], eax
xor eax, dword [0x1075e9c]
inc ebx
call fcn.01005662
inc edi
ror esi, 5
mov dword [0x10756fe], 0xfa37866b
rol esi, 0x14
sub edx, dword [0x1075b65]
not ebx
call fcn.01037f55
neg eax
dec edi
xor dword [0x10756d5], esi
aad 0x56
pop es
add dword [edi + 0x29f387f3], eax
cmp eax, 0x10758cc
inc edi
neg eax
not ebx
ror esi, 0x14
rol esi, 5
dec edi
dec ebx
call fcn.01032ce2
not eax
ror eax, 0x16
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, edi
call fcn.010365cb
not ebx
xor dword [0x10757e5], edi
add esi, dword [0x1075e30]
ror eax, 0x1d
xor ecx, dword [0x1075e94]
call fcn.0100c08c
sub edx, ecx
mov dword [0x10758d7], 0x24cf186c
call fcn.0101c315
xor edi, dword [0x1075bcc]
inc eax
call fcn.01010495

Function at 0x1067278
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0105875a
dec eax
call fcn.0105875a
add edx, ecx
call fcn.0102ec01
rol eax, 0x1d
not ebx
call fcn.01048653
xor ebx, edi
add esp, 0x14
add edi, dword [0x1075d55]
add esi, ecx
neg edx
add edx, dword [0x1075ba0]
add ebx, 0x963edab7
neg esi
add esi, 0x9fbcf28f
xchg edi, edx
neg esi
add dword [0x1075a26], 0xaafb0e1
xchg ecx, eax
xor dword [0x10757c7], eax
and dword [0x10757cd], ecx
xchg ecx, eax
add dword [0x1075764], 0x9cff1354
neg esi
xchg edi, edx
sub esi, 0x9fbcf28f
neg esi
sub ebx, 0x963edab7
neg edx
sub esi, ecx
mov edi, 0xffcb69cd
add ebx, dword [0x1075c25]
xor edx, dword [0x1075eab]
sub edx, dword [0x1075acc]
not ecx
dec edx
not eax
inc esi
dec ecx
xor ebx, dword [0x1075f64]
mov dword [0x1075692], esi
dec ebx
xor dword [0x1075980], edx
add ebx, dword [0x1075e4e]
call fcn.0105e464
xor dword [0x107589f], ecx
ror ecx, 0x15
call fcn.01033092
add eax, ebx
xor esi, dword [0x1075b37]
sub eax, ebx
call fcn.01048df2
sbb bh, dh
inc ecx
rcl dword [0xfd7b5ae8], 0xff
xor dword [0x10758ff], ebx
inc ebx
add dword [0x1075a19], edi
inc ecx
dec esi
not eax
inc edx
not ecx
sub edi, 0xb2e53440
rol ebx, 0x1b
sub edi, dword [0x1075b35]
mov dword [0x1075732], 0xf2d88fc7
xor ebx, eax
sub edx, 0x795b9557
add eax, ebp
or esi, dword [0x1075e4b]
neg esi
sub esi, 0x13d00cfc
mov dword [0x10755fa], 0x299e732
dec edi
sub ebx, dword [0x1075c37]
call fcn.0101c315
call fcn.010342a7
call fcn.01041c30
call fcn.0100c08c
inc edi
invalid
invalid
Function at 0x106734b
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0105875a
dec eax
call fcn.0105875a
add edx, ecx
call fcn.0102ec01
rol eax, 0x1d
not ebx
call fcn.01048653
xor ebx, edi
add esp, 0x14
add edi, dword [0x1075d55]
add esi, ecx
neg edx
add edx, dword [0x1075ba0]
add ebx, 0x963edab7
neg esi
add esi, 0x9fbcf28f
xchg edi, edx
neg esi
add dword [0x1075a26], 0xaafb0e1
xchg ecx, eax
xor dword [0x10757c7], eax
and dword [0x10757cd], ecx
xchg ecx, eax
add dword [0x1075764], 0x9cff1354
neg esi
xchg edi, edx
sub esi, 0x9fbcf28f
neg esi
sub ebx, 0x963edab7
neg edx
sub esi, ecx
mov edi, 0xffcb69cd
add ebx, dword [0x1075c25]
xor edx, dword [0x1075eab]
sub edx, dword [0x1075acc]
not ecx
dec edx
not eax
inc esi
dec ecx
xor ebx, dword [0x1075f64]
mov dword [0x1075692], esi
dec ebx
xor dword [0x1075980], edx
add ebx, dword [0x1075e4e]
call fcn.0105e464
xor dword [0x107589f], ecx
ror ecx, 0x15
call fcn.01033092
add eax, ebx
xor esi, dword [0x1075b37]
sub eax, ebx
call fcn.01048df2
sbb bh, dh
inc ecx
rcl dword [0xfd7b5ae8], 0xff
xor dword [0x10758ff], ebx
inc ebx
add dword [0x1075a19], edi
inc ecx
dec esi
not eax
inc edx
not ecx
sub edi, 0xb2e53440
rol ebx, 0x1b
sub edi, dword [0x1075b35]
mov dword [0x1075732], 0xf2d88fc7
xor ebx, eax
sub edx, 0x795b9557
add eax, ebp
or esi, dword [0x1075e4b]
neg esi
sub esi, 0x13d00cfc
mov dword [0x10755fa], 0x299e732
dec edi
sub ebx, dword [0x1075c37]
call fcn.0101c315
call fcn.010342a7
call fcn.01041c30
call fcn.0100c08c
inc edi
invalid
invalid

Function at 0x10673c3
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [0xab01075a], al
sub dword [edi - 0x3397e5c], 0xf713d00c
fisubr word [ebx]
lds eax, [ecx + 0x5b9557c2]
jns 0x106740f
fadd st(1)
retf
into
add dword [ebx], esi
shr eax, 1
std
dec esi
sti
inc dword [ebx]
cmp eax, 0x1075c35

Function at 0x1067425
Capabilities:
Hash data using murmur3

Disassembly:
xchg edi, esi
xor edx, ecx
rol esi, 1
or dword [0x1075a4a], 0x90965309
inc ecx
not esi
inc edi
rol esi, 0x1a
dec ebx
call fcn.0101c315
dec edi
neg ebx
dec edi
call fcn.010368b9
add ebx, edx
push edi
rol esi, 0x12
and dword [0x10758a2], edx
not esi
ror eax, 0x1d
add edx, esp
dec edx
xor ecx, dword [0x1075ab7]
or eax, dword [0x1075ace]
or esi, dword [0x1075b02]
xor eax, 0x1075b02

Function at 0x106746d
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, 0x1075b02
not ecx
mov dword [0x1075784], esi
xchg ecx, edx
sub esi, dword [0x1075b95]
ror ecx, 1
call fcn.0102ec01
ror eax, 0x1e
xor eax, 0xc1877429
dec edx
call fcn.0104894c
inc edx
xor eax, 0xc1877429
rol eax, 0x1e
call fcn.0101c315
rol ecx, 1
xchg ecx, edx
and dword [0x1075900], edi
add edi, esi
rol dword [edx + 0x2b], 1
aam 0xc1
rcr byte [0xd89d6f7], 8
pop edx
pop es
add ecx, eax
into
adc bh, byte [ebx - 0x7ed7b108]
ror edi, 0x1d
not ecx
or eax, dword [0x1075ac0]
xor eax, dword [0x1075b44]
ror ebx, 1
dec esi
neg esi
add edx, 0xe720de1b
xchg ecx, esi
add ecx, dword [0x1075b27]
xchg eax, edx
add dword [0x1075972], 0x4db23740
dec ebx
Function at 0x10674b2
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, 0x1075b02
not ecx
mov dword [0x1075784], esi
xchg ecx, edx
sub esi, dword [0x1075b95]
ror ecx, 1
call fcn.0102ec01
ror eax, 0x1e
xor eax, 0xc1877429
dec edx
call fcn.0104894c
inc edx
xor eax, 0xc1877429
rol eax, 0x1e
call fcn.0101c315
rol ecx, 1
xchg ecx, edx
and dword [0x1075900], edi
add edi, esi
rol dword [edx + 0x2b], 1
aam 0xc1
rcr byte [0xd89d6f7], 8
pop edx
pop es
add ecx, eax
into
adc bh, byte [ebx - 0x7ed7b108]
ror edi, 0x1d
not ecx
or eax, dword [0x1075ac0]
xor eax, dword [0x1075b44]
ror ebx, 1
dec esi
neg esi
add edx, 0xe720de1b
xchg ecx, esi
add ecx, dword [0x1075b27]
xchg eax, edx
add dword [0x1075972], 0x4db23740
dec ebx

Function at 0x10674fd
Capabilities:
Hash data using murmur3

Disassembly:
xchg ebx, esi
or edx, dword [0x1075ce7]
xchg ebx, esi
inc ebx
xchg eax, edx
xchg ecx, esi
sub edx, 0xe720de1b
neg esi
inc esi
rol ebx, 1
not ecx
rol edi, 0x1d
add ebx, 0x341ebfe6
xor dword [0x10759e1], 0x17980245
add ecx, 0xaec00c51
sub ecx, dword [0x1075b1d]
rol ebx, 0x1e
sub ecx, eax
call fcn.0102ec01
sub edi, 0x12be2df2
xor edi, eax
inc edx
add edx, esp
call fcn.01060423
sub edx, esp
dec edx
xor edi, eax
add edi, 0x12be2df2
sub eax, 0x6ce812be
invalid
std
inc dword [ebx]
enter 0xffffffffffffcbc1, 0x1e
sub ecx, 0xaec00c51
add dword [0x10759e2], 0x9ec42efe
add ebx, 0xae285d8e
or dword [0x1075770], eax
inc esi
xchg edi, esi
xor edi, dword [0x1075dc0]
add dword [0x10758c8], eax
sub dword [0x1075952], 0x65b95e93
add dword [0x1075702], 0xdce2da03
call fcn.0100c08c
xor ecx, 0x6c6b2451
call fcn.01032315
add dword [0x10757e9], 0x66ae4fdf
or esi, dword [0x1075bb5]
neg esi
xchg eax, esi
not ecx
dec edx
or dword [0x10758fb], edx
add dword [ecx + 0x75a393d], ecx
add dword [ebx], ebp
xor eax, 0x1075c07

Function at 0x10675d3
Capabilities:
Hash data using murmur3

Disassembly:
add dword [ecx + 0x75a393d], ecx
add dword [ebx], ebp
xor eax, 0x1075c07
mov dword [0x1075963], edx
call fcn.0103e93b
call fcn.0104bc29
sub dword [0x10756c0], edx
xor dword [0x10759c3], esi
inc edx
not ecx
xchg eax, esi
neg esi
mov dword [0x1075a94], 0x190a069b
call fcn.0102137d
xor ecx, 0x6c6b2451
or dword [0x107579f], 0x4b823af2
xor dword [0x10755b3], 0x2f69158d
xor eax, 0x10755b3
lea edx, [0xd212f69]
ficom dword [ebp + 7]
add dword [edi + 0x15214ef7], eax
ret 0x757
add dword [ebx + 0x4b], edx
xor edi, ebp
inc edx
not eax
or dword [0x10756e4], ebx
sub esi, ebp
call fcn.01005662
ror edx, 0x15
add eax, dword [0x1075c49]
inc ebx
call fcn.0101c315
sub edi, esi
dec eax
xchg edi, edx
inc edx

Function at 0x1067664
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, dword [0x1075f5a]
sub eax, esi
add eax, esi
dec edx
xchg edi, edx
inc eax
add edi, esi
dec ebx
rol edx, 0x15
call fcn.0101f354
add esi, ebp
add dword [0x1075944], edi
not eax
dec edx
xor edi, ebp
inc ebx
mov ecx, 0x93173a74
or dword [0x10759a3], edx