joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002efd2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002efed
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1002f083
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, 0x3b57
inc eax
mov ecx, dword [ebp - 8]
sub eax, dword [ecx]
cmp eax, 0x3b28
jg 0x1002f044
mov dword [ebp - 4], 1
jmp 0x1002f048
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
imul eax, dword [ebp - 4], 0xffffffff
test eax, eax
je 0x1002f062
push 0
mov ecx, dword [ebp - 0x28]
call fcn.1001ae71
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1002f077
mov dword [ebp - 0xc], 1
jmp 0x1002f07b
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1002f393
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002f3e8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x4117
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax]
push 0x6d2c
push 1
mov eax, dword [ebp - 0x18]
push dword [eax]
call fcn.1002e78a
add esp, 0x18
jmp 0x1002f408
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1002f408
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esp, ebp
pop ebp
ret
Function at 0x10037653
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10037683
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10037681
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x100376d9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
push 0
push 0x6844
push 0x56c4
call fcn.1002de51
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x10038383
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
push 0x29c7
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20a2
call fcn.100380f6
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100383bd
xor eax, eax
jmp 0x10038500
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10038164
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100383e5
xor eax, eax
jmp 0x10038500
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.100381c9
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x10038404
xor eax, eax
jmp 0x10038500
lea eax, [ebp - 4]
push eax
push 0x7cd6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 1
push 0xa28
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.10037f78
add esp, 0x20
lea eax, [ebp + 8]
push eax
push 0x7f77
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x629b
push 1
call fcn.10038225
add esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1390
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.100382cb
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x10038482
push 0x5b72
push dword [ebp - 4]
push 1
push dword [ebp - 0x14]
push 0x38
call fcn.10031243
add esp, 0x14
push dword [ebp - 4]
call fcn.1003778d
pop ecx
test eax, eax
jne 0x10038493
xor eax, eax
jmp 0x10038500
push 0x68ee
lea eax, [ebp - 4]
push eax
push 1
call fcn.10038333
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100384e8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100384c5
xor eax, eax
jmp 0x10038500
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100384de
xor eax, eax
jmp 0x10038500
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100384f9
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100384fd
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10054371
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100543cc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100543ad
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x100543ca
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.1001ae71
mov dword [eax], 0x1d018875
jmp 0x100543a2
jmp 0x100543e0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100543e0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret

Function at 0x1005483e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1005485b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1005492f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x12f3ccd2
jg 0x100548d2
mov dword [ebp - 0x34], 1
jmp 0x100548d6
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
neg eax
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jge 0x100548ff
mov dword [ebp - 0x14], 1
jmp 0x10054903
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub edx, dword [ecx]
cmp dword [eax], edx
jg 0x10054923
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10054923
mov dword [ebp - 0x1c], 1
jmp 0x10054927
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10080432
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a38c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100729ac
mov dword [ebp - 0x14], eax
cmp dword [0x106770fc], esi
jne 0x10080525
push 0x800
push esi
push 0x10007a0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100804b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10080605
push esi
push esi
push 0x10007a0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10080605
push 0x10007a24
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080605
push eax
call ebx
push 0x10007a30
push edi
mov dword [0x106770fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a40
push edi
mov dword [0x10677100], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a54
push edi
mov dword [0x10677104], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067710c], eax
test eax, eax
je 0x10080522
push 0x10007a70
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10677108], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1008054a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1008053d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1008055f
push 4
pop eax
jmp 0x10080607
cmp dword [ebp - 0x14], esi
je 0x1008055f
push dword [0x106770fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10080544
mov eax, dword [0x10677108]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100805bd
cmp dword [0x1067710c], edi
je 0x100805bd
push eax
call ebx
push dword [0x1067710c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100805bd
test eax, eax
je 0x100805bd
call ecx
test eax, eax
je 0x100805b2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100805b2
test byte [ebp - 8], 1
jne 0x100805bd
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100805ed
mov eax, dword [0x10677100]
cmp eax, edi
je 0x100805ea
push eax
call ebx
test eax, eax
je 0x100805ea
call eax
mov esi, eax
test esi, esi
je 0x100805ea
mov eax, dword [0x10677104]
cmp eax, edi
je 0x100805ea
push eax
call ebx
test eax, eax
je 0x100805ea
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106770fc]
call ebx
test eax, eax
je 0x10080605
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10080607
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x477ab4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov ebp, dword [esp + 0x78]
mov ebx, dword [esp + 0x80]
mov edi, dword [esp + 0x88]
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call fcn.004719f8
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x477cac
cmp dword [esp + 0x98], 5
jbe 0x477c04
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov esi, dword [esp + 0x8c]
test esi, esi
je 0x477c5c
mov esi, dword [esp + 0x7c]
inc esi
mov eax, dword [esp + 0x7c]
add eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x477cf0
lea ebp, [eax - 1]
cmp dword [esp + 0x8c], 1
sbb eax, eax
or eax, 1
mov dword [esp + 0x24], eax
cmp dword [esp + 0x90], 1
sbb eax, eax
and eax, 2
dec eax
mov dword [esp + 0x20], eax
mov edx, edi
shr edx, 0x1f
add edx, edi
sar edx, 1
add edx, ebx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x94]
test edx, edx
je 0x477b93
mov edx, edi
and edx, 1
cmp edx, 1
sbb dword [esp + 0x30], 0xffffffff
add edi, ebx
mov dword [esp + 0x28], edi
cmp ebx, edi
jge 0x477ccc
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov edi, ebp
sub edi, esi
jmp 0x477bf3
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call fcn.0047326c
add esi, dword [esp + 0x24]
add ebp, dword [esp + 0x20]
inc ebx
add edi, dword [esp + 0x2c]
cmp ebx, dword [esp + 0x28]
je 0x477ccc
cmp esi, ebp
jge 0x477bdc
cmp dword [esp + 0x30], ebx
jg 0x477bb4
mov ecx, dword [esp + 0x38]
jmp 0x477bb8
mov eax, dword [esp + 0x98]
jmp dword [eax*4 + 0x6103a8]
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x477cfc
mov eax, dword [ebp + 0x3c]
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 8]
mov dword [esp + 0x38], eax
jmp 0x477b18
mov eax, dword [ebp + 0x30]
mov eax, dword [eax + 8]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax + 8]
mov dword [esp + 0x38], eax
mov esi, dword [esp + 0x8c]
test esi, esi
jne 0x477b27
mov eax, dword [esp + 0x7c]
lea esi, [eax + edi - 1]
invalid
Function at 0x4fc074
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [esp + 0x7c]
mov dword [esp], ebx
call fcn.004fe628
mov edi, dword [ebx]
mov edx, dword [ebx + 8]
dec edx
test ebp, ebp
je 0x4fc178
mov eax, dword [esp + 0x74]
test eax, eax
je 0x4fc18c
mov eax, dword [esp + 0x78]
test eax, eax
js 0x4fc199
mov eax, 3
jmp 0x4fc0d8
lea eax, [eax + eax + 1]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004fe6f8
mov edi, dword [ebx]
add edi, esi
mov edx, esi
not edx
add edx, dword [ebx + 4]
mov eax, 2
lea ecx, [esp + 0x4c]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x3c], edx
call dword [ebp + 4]
mov esi, dword [esp + 0x48]
add esi, edi
sub esi, dword [ebx]
cmp eax, 0xfffffffc
mov edx, dword [esp + 0x3c]
jne 0x4fc160
mov eax, dword [esp + 0x44]
add dword [esp + 0x74], eax
sub dword [esp + 0x78], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4fc0b8
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx + 4]
jmp 0x4fc0b8
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004fe6f8
mov eax, dword [ebx]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [0x68b8fc]
mov eax, dword [esp + 0x74]
test eax, eax
jne 0x4fc0a5
nop
mov dword [esp + 0x78], 0
jmp 0x4fc0b1
mov ecx, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 0x3c], edx
call dword [ebp + 0x18]
mov dword [esp + 0x78], eax
mov edx, dword [esp + 0x3c]
jmp 0x4fc0b1
Function at 0x4fe768
Capabilities:
Hash data using murmur3

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
lea esi, [ebx + 0xc]
cmp eax, esi
je 0x4fe782
mov dword [esp], eax
call fcn.004ee144
mov dword [ebx], esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0xc8
call fcn.00577ac8
cmp dword [0x5e8c19], 0x9b3dcc46
add byte [esi - 0x34], al
invalid
wait
ja 0x4fe7a5
or eax, esp
xor edi, 0x60625636
sub eax, 0x29c64595
xor edi, dword [0x5f1456]
dec ecx
xor esi, 0x35ea7a84
xchg eax, esi
shl ecx, 0x1d
xor ecx, ecx
xor dword [0x5f78f0], ecx
cmp ecx, 0x482b38f1
js 0x4fe7d5
and ebx, ecx
xor eax, esi
sub ecx, edx
xor edi, 0xd0493453
mov ecx, 0x70342b68
and eax, dword [str.Horizontal.Scale.track]
dec eax
sub edi, edx
rol edi, 0x10
ror edi, 7
add edx, 0x3c8e47bd
sub eax, dword [0x5e5026]
shl eax, 0x1f
add edi, 0xc21e37a8
rol esi, 0x1b
dec ecx
jne 0x4fe7e4
mov ecx, 0x425fa983
and eax, ebx
mov esi, edi
add dword [0x5f7b3d], ebx
not edx
test esp, ecx
jne 0x4fe827
ror esi, 0xd
shr edx, 0xa
ror esi, 0xe
sub esi, 0x27118e17
shl eax, 0xe
neg ebx
xchg edi, eax
xor dword [0x5f7a43], 0x56d7ea54
sub edi, 0xfeb5029e
mov ebx, dword [0x5f38a2]
add eax, edx
mov ebx, 0xb2b26993
or esi, eax
dec ecx
jne 0x4fe814
cmp dword [0x5ebd81], 0x489d5e81
js 0x4fe86b
not eax
add dword [0x5f784c], edx
test esi, ebp
jae 0x4fe877
xor esi, esi
not edi
or edx, edi
inc ecx
and ebx, 0x180a722b
call fcn.0057c1b1
mov eax, 0xe67a122
add edi, dword [0x5f7c66]
call fcn.00421867
inc edi
dec ecx
rol ebx, 0x11
dec edi
ror edi, 0xd
dec ecx
xchg ecx, edx
sub dword [0x5f799c], ecx
add ecx, dword [0x5f7d18]
xchg ecx, eax
neg esi
sub dword [0x5f7861], 0x640bfe31
inc ebx
xor ebx, esi
rol esi, 0x1e
dec esi
call fcn.00436c4e
inc esi
ror esi, 0x1e
xor ebx, esi
dec ebx
xor dword [0x5f7b25], 0x17060786
neg esi
xchg ecx, eax
add dword [0x5f7b9b], edi
xchg ecx, edx
inc ecx
rol edi, 0xd
inc edi
invalid
Function at 0x4fe79c
Capabilities:
Hash data using murmur3

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx]
lea esi, [ebx + 0xc]
cmp eax, esi
je 0x4fe782
mov dword [esp], eax
call fcn.004ee144
mov dword [ebx], esi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0xc8
call fcn.00577ac8
cmp dword [0x5e8c19], 0x9b3dcc46
add byte [esi - 0x34], al
invalid
wait
ja 0x4fe7a5
or eax, esp
xor edi, 0x60625636
sub eax, 0x29c64595
xor edi, dword [0x5f1456]
dec ecx
xor esi, 0x35ea7a84
xchg eax, esi
shl ecx, 0x1d
xor ecx, ecx
xor dword [0x5f78f0], ecx
cmp ecx, 0x482b38f1
js 0x4fe7d5
and ebx, ecx
xor eax, esi
sub ecx, edx
xor edi, 0xd0493453
mov ecx, 0x70342b68
and eax, dword [str.Horizontal.Scale.track]
dec eax
sub edi, edx
rol edi, 0x10
ror edi, 7
add edx, 0x3c8e47bd
sub eax, dword [0x5e5026]
shl eax, 0x1f
add edi, 0xc21e37a8
rol esi, 0x1b
dec ecx
jne 0x4fe7e4
mov ecx, 0x425fa983
and eax, ebx
mov esi, edi
add dword [0x5f7b3d], ebx
not edx
test esp, ecx
jne 0x4fe827
ror esi, 0xd
shr edx, 0xa
ror esi, 0xe
sub esi, 0x27118e17
shl eax, 0xe
neg ebx
xchg edi, eax
xor dword [0x5f7a43], 0x56d7ea54
sub edi, 0xfeb5029e
mov ebx, dword [0x5f38a2]
add eax, edx
mov ebx, 0xb2b26993
or esi, eax
dec ecx
jne 0x4fe814
cmp dword [0x5ebd81], 0x489d5e81
js 0x4fe86b
not eax
add dword [0x5f784c], edx
test esi, ebp
jae 0x4fe877
xor esi, esi
not edi
or edx, edi
inc ecx
and ebx, 0x180a722b
call fcn.0057c1b1
mov eax, 0xe67a122
add edi, dword [0x5f7c66]
call fcn.00421867
inc edi
dec ecx
rol ebx, 0x11
dec edi
ror edi, 0xd
dec ecx
xchg ecx, edx
sub dword [0x5f799c], ecx
add ecx, dword [0x5f7d18]
xchg ecx, eax
neg esi
sub dword [0x5f7861], 0x640bfe31
inc ebx
xor ebx, esi
rol esi, 0x1e
dec esi
call fcn.00436c4e
inc esi
ror esi, 0x1e
xor ebx, esi
dec ebx
xor dword [0x5f7b25], 0x17060786
neg esi
xchg ecx, eax
add dword [0x5f7b9b], edi
xchg ecx, edx
inc ecx
rol edi, 0xd
inc edi
invalid
Function at 0x4fe910
Capabilities:
Hash data using murmur3

Disassembly:
not esi
call fcn.00454660
xchg esi, eax
add dword [0x5f7a11], ebx
call fcn.0051a84e
and dword [0x5f7939], edx
not edi
xor dword [0x5f79cc], esi
add esi, 0x2324700a
not ecx
sub esi, dword [0x5f7de5]
call fcn.0051cf4f
call fcn.004796cd
not ecx
sub esi, 0x2324700a
sub dword [0x5f7a29], edx
not edi
call fcn.004a3218
and dword [0x5f7914], edi
xchg esi, eax
call fcn.00466af2
not esi
rol edi, 0xc
xor eax, edi
xchg esi, edx
xor ecx, ebx
not eax
ror eax, 0x1f
dec ecx
sub eax, 0x516af0e1
not ecx
xor eax, edi
call fcn.00579dff
xor edx, dword [0x5f7fbc]
call fcn.004922ea
add edx, 0x432907e7
sub edi, ebp
xor edi, esp
dec eax
rol edx, 0x1c
xor esi, 0x6dadeb64
rol edx, 0x12
add dword [0x5f7863], 0xbc84176a
neg ecx
add edx, 0x8355cf6e
or esi, dword [0x5f7e68]
call fcn.0049020c
call fcn.004188d6
sub edx, 0x8355cf6e
neg ecx
or dword [0x5f786c], 0x71bb3a29
ror edx, 0x12
xor esi, 0x6dadeb64
ror edx, 0x1c
inc eax
xor edi, esp
add edi, ebp
sub edx, 0x432907e7
call fcn.004786be
call fcn.0045331c
xor eax, edi
not ecx
push eax
sub edx, 0x14192d58
not esi
dec edi
sub esi, 0x8269a370
or dword [0x5f7980], eax
add ecx, dword [0x5f7cf5]
ror eax, 0xc
dec edx
call fcn.00405e01
or dword [0x5f7970], edx
add eax, esi
or dword [0x5f7a02], edx
ror edi, 0x1b
xor dword [0x5f7b41], edi
call fcn.00481a67
xor eax, 0x9292d0ec
sub edx, dword [0x5f7d8c]
dec ebx
neg esi
or edi, dword [0x5f7f65]
neg esi
inc ebx
xor eax, 0x9292d0ec
sub dword [0x5f79ea], eax
rol edi, 0x1b
sub eax, esi
and dword [0x5f78b7], esi
call fcn.00537a9c
inc edx
rol eax, 0xc
xor dword [0x5f7a06], ebx
add esi, 0x8269a370
inc edi
not esi
add edx, 0x14192d58
mov ebx, 0x4e9375a
xor ecx, dword [0x5f7f47]
dec ebx
xor dword [0x5f799e], edi
neg edx
call fcn.00443a71
xor eax, 0x962bd88e
dec edx
sub edi, 0x461bbbfc
sub edx, dword [0x5f7d59]
add dword [0x5f7b82], ecx
xchg edx, esi
xor ebx, 0x43a45931
or eax, dword [0x5f7cfe]
xchg eax, esi
sub eax, dword [0x5f7eea]
xchg eax, esi
xor ebx, 0x43a45931
xchg edx, esi
or dword [0x5f7b60], eax
add edi, 0x461bbbfc
inc edx
xor eax, 0x962bd88e
call fcn.00477c65
neg edx
xor dword [0x5f7afa], ebx
inc ebx
or ebx, 0x2bcb4ca5
neg esi
xor edx, 0x6b904b62
add dword [0x5f7a0e], ecx
sub ecx, 0xced315ca
xor dword [0x5f7a43], 0x173bfe99
sub esi, dword [0x5f7e5c]
call fcn.00590f29
rol esi, 4
add esi, dword [0x5f7e5f]
invalid
invalid
invalid
invalid
Function at 0x4ff400
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
xchg byte [eax + 0x5f], bh
add byte [eax - 0x41], cl
and bh, ah
rcr byte [edi - 0x3f], cl
invalid
jae 0x4ff359
neg esi
mov dword [0x5f79fd], edx
call fcn.0052792b
or ebx, dword [0x5f7c86]
or edi, dword [0x5f7f25]
xor edx, ebx
call fcn.0040a296
ror edx, 0x19
call fcn.004a1abb
inc esi
xor esi, edx
xor eax, dword [0x5f7f23]
not eax
xor edx, 0x4870c771
jno 0x4ff3c9
jo 0x4ff44c
jno 0x4ff3c9
jo 0x4ff44c
not ebx
rol edx, 0xf
or eax, dword [0x5f7c45]
add eax, esi
not eax
call fcn.0043571c
not eax
sub eax, esi
ror edx, 0xf
not ebx
invalid
invalid
invalid

Function at 0x4ff438
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add byte [ebx], dh
ror dword [ecx + 0x5f7a553d], cl
add bh, dh
fiadd word [ecx - 0x7871ba11]
sahf

Function at 0x4ff474
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jo 0x4ff46f
mov dword [ebx], 0x5f7fa83d
add byte [ecx], ch
sbb eax, 0x5f7b22