joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4159ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x415a13
call fcn.0040df9b
mov dword [eax], esi
call fcn.0040df88
push 0x16
pop esi
mov dword [eax], esi
call fcn.00413220
mov eax, esi
jmp 0x415a68
test dword [ebp + 0xc], 0xfffffff9
jne 0x4159f9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x415a40
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040dfae
pop ecx
call fcn.0040df88
mov eax, dword [eax]
jmp 0x415a68
test al, 0x10
jne 0x415a66
test al, 1
je 0x415a66
test byte [ebp + 0xc], 2
je 0x415a66
call fcn.0040df9b
mov dword [eax], 5
call fcn.0040df88
mov dword [eax], 0xd
jmp 0x415a37
xor eax, eax
pop esi
pop ebp
ret

Function at 0x416c48
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b6d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411a61
and dword [ebp - 0x14], 0
cmp dword [0x42d9b0], 0
mov dword [ebp - 0x18], eax
jne 0x416cfb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x416da3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x416da3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d9b0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d9b4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d9b8], eax
call edi
push eax
call esi
mov dword [0x42d9c0], eax
test eax, eax
je 0x416cfb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d9bc], eax
mov eax, dword [0x42d9bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x416d54
cmp dword [0x42d9c0], ecx
je 0x416d54
push eax
call esi
push dword [0x42d9c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x416d54
test ebx, ebx
je 0x416d54
call edi
test eax, eax
je 0x416d4b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x416d4b
test byte [ebp - 8], 1
jne 0x416d54
or dword [ebp + 0x10], 0x200000
jmp 0x416d87
mov eax, dword [0x42d9b4]
cmp eax, dword [ebp - 0x18]
je 0x416d87
push eax
call esi
test eax, eax
je 0x416d87
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416d87
mov eax, dword [0x42d9b8]
cmp eax, dword [ebp - 0x18]
je 0x416d87
push eax
call esi
test eax, eax
je 0x416d87
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d9b0]
call esi
test eax, eax
je 0x416da3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416da5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b172
leave
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4015c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a5cf
mov dword [esp + 0x28], 0
test esi, esi
jne 0x401606
xor eax, eax
jmp 0x401609
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x10]
call fcn.0040ac04
lea eax, [edi + 0x7c]
test eax, eax
je 0x401624
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040af69
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
test ebx, ebx
je 0x401662
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040af69
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0040a2e9
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040ac85
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402960
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5624e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x118]
mov edi, ecx
push eax
push edi
mov byte [ebp - 0x105], 1
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
jne 0x4029a4
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f7741
mov esp, ebp
pop ebp
ret
push esi
call fcn.004034cc
mov ecx, dword [ebp - 0x118]
add esp, 4
push eax
push esi
push ecx
push edi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x402992
mov edi, dword [ebp - 0x10c]
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x114]
push eax
push str.VarFileInfoTranslation
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
xor esi, esi
test dword [ebp - 0x10c], 0xfffffffc
mov dword [ebp - 0x110], esi
jbe 0x402a74
jmp 0x402a00
mov eax, dword [ebp - 0x114]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
lea eax, [ebp - 0x104]
push str.StringFileInfo_04x_04xProductVersion
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x110]
push ecx
push ebx
lea edx, [ebp - 0x104]
push edx
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jns 0x402a49
mov byte [ebp - 0x105], 0
jmp 0x402a66
mov eax, dword [ebp - 0x110]
dec eax
mov ecx, dword [ebx]
js 0x402a66
cmp word [ecx + eax*2], 0x2e
je 0x402a60
dec eax
jns 0x402a54
jmp 0x402a66
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x10c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x402a00
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x105]
pop edi
xor ecx, ebp
pop esi
call fcn.004f7741
mov esp, ebp
pop ebp
ret

Function at 0x402ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402f52
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x402f21
cmp eax, 2
jne 0x402f3c
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x402f4c
test eax, eax
je 0x402f47
test al, 1
jne 0x402f3c
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x402f4c
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40317b
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4031b2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4031ae
jmp 0x4031a0
cmp esi, eax
jae 0x4031b2
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4031a0
cmp esi, eax
jb 0x4031b9
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4038af
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x512b7d
call fcn.004f8665
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x4038d4
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x403926
call fcn.0040c4c3
push eax
lea ecx, [ebp - 0x10]
call fcn.00401c50
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f81b4
push eax
call fcn.004030d0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401d00
mov eax, esi
call fcn.004f873d
ret 8

Function at 0x40a1be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40a205
call fcn.0040d42d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40a205
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40a221
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00409cbe
mov esi, eax
test edi, edi
je 0x40a21f
test ebx, ebx
je 0x40a21f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e1dd
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5624e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x40e222
push 0x51d160
push 4
push eax
call fcn.004f8c26
push eax
call fcn.004030d0
add esp, 0x10
jmp 0x40e238
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40e2b8
push edi
call fcn.004f8bdd
mov edi, dword [eax]
call fcn.004f8bdd
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004f8b7a
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004f8bdd
cmp dword [eax], 0
je 0x40e28c
call fcn.004f8bdd
push dword [eax]
call fcn.0040392e
pop ecx
jmp 0x40e293
call fcn.004f8bdd
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x40e2b8
cmp dword [ebp - 0x234], esi
jae 0x40e2b8
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40e2ba
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f7741
leave
ret
Function at 0x40e7f9
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x5624e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.00405493
pop ecx
cmp eax, esi
je 0x40e8e3
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x40e8e3
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.004f8790
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x40e8e3
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x40e8e3
cmp esi, 0x14
jge 0x40e8e3
push 0x10
push 0
push edi
call fcn.004fa843
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40e8d2
call fcn.004f8bdd
cmp dword [eax], 0x22
je 0x40e8d2
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.004f876f
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x40e8a8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x56579c], 0
jne 0x40e96e
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x40e997
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0040e1dd
pop ecx
pop ecx
test eax, eax
jne 0x40e999
inc edi
cmp edi, esi
jl 0x40e974
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f7741
leave
ret 8

Function at 0x410fc4
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ecx], vtable.CMapPtrToPtr.0
jmp fcn.0043f648
Function at 0x414300
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5624e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x414335
xor eax, eax
jmp 0x414388
lea eax, [ebp - 0x210]
push eax
call fcn.004f876f
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x414366
push 0x51d8c8
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004f7dc2
add esp, 0xc
test eax, eax
jne 0x414331
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004f7dc2
add esp, 0xc
test eax, eax
jne 0x414331
lea eax, [ebp - 0x210]
push eax
call fcn.00405493
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f7741
leave
ret

Function at 0x43f6ac
Capabilities:
Hash data using murmur3

Disassembly:
push esi
add byte [ecx - 0x61d3611], al
loop 0x43f6a7
loop 0x43f6a7
mov bh, 0x81
invalid

Function at 0x43f777
Capabilities:
Hash data using murmur3

Disassembly:
mov edx, dword [0xe764ca81]
xchg edi, eax
jecxz 0x43f701
invalid
Function at 0x43f7f5
Capabilities:
Hash data using murmur3

Disassembly:
rol edx, 6
ror eax, 0xb
or dword [0x56b8a3], ebx
xor dword [0x56b9c5], ecx
ror ebx, 0xc
dec eax
shr edi, 3
xor dword [0x56b7dc], 0x20d5ae7b
and edi, 0x851f24e7
and al, 0x1f
test dword [ebx], ecx
clc
and al, 0x1f
test dword [ebx], ecx
clc
add ebx, dword [0x563545]
cmp dword [0x5637c7], 0x767d8f32
jle 0x43f80f
shr edi, 0x19
not esi
rol edi, 0x14
and edi, 0x71788c25
not esi
sub dword [0x56b911], eax
dec ecx
jne 0x43f7cf
inc esi
shr ebx, 0x1b
sub esi, edx
or edi, 0xfea163ab
dec edi
inc ecx
and eax, 0xe5404b97
sub eax, ebx
sub ecx, 0xaec25c98
dec eax
add ebx, ecx
mov ecx, 0x6a9e4da4
and edi, 0x4eaefa36
call fcn.0050cd7f
ror eax, 0x14
neg ebx
add edi, esp
rol esi, 4
dec ebx
rol ebx, 1
ror edx, 0xc
dec ebx
dec ecx
jne 0x43f84a
mov ebx, 0xb98993ab
or dword [0x56ba4c], edx
sub eax, dword [0x56be75]
xchg ecx, eax
xor ecx, dword [0x56bdb8]
call fcn.00459767
add edi, ebx
xor edx, dword [0x56bd84]
xor eax, dword [0x56bb7b]
call fcn.004bf753
not esi
add esi, 0x25770502
add edi, dword [0x56be43]
xchg ebx, esi
call fcn.004e60fc
call fcn.0040ad2c
xchg ebx, esi
sub esi, 0x25770502
not esi
call fcn.0044a725
sub edi, ebx
xchg ecx, eax
add dword [0x56b7a6], eax
and ebx, 0x928ef476
add ebx, ecx
call fcn.004913ba
not edx
and dword [0x56b88c], esi
xor ebx, dword [0x56bd93]
call fcn.004b962c
add esi, 0xd126d7e0
sub ebx, dword [0x56bdfa]
add ebx, ebp
neg ebx
call fcn.004d7aa8
and dword [0x56b94d], edx
add eax, dword [0x56bc4c]
rol esi, 0xe
neg esi
add ebx, esp
mov dword [0x56ba37], edx
xor ebx, 0x2345f1be
xchg esi, eax
not edi
call fcn.004f4fd4
not edi
xchg esi, eax
xor ebx, 0x2345f1be
xor dword [0x56b955], esi
sub ebx, esp
neg esi
ror esi, 0xe
or dword [0x56bb52], edi
call fcn.00423279
neg ebx
sub ebx, ebp
sub esi, 0xd126d7e0
call fcn.0048da40
and dword [0x56b990], eax
add bh, dh
shr al, cl
insd dword es:[edi], dx
imul ecx, dword [ebx], 0
sub ebx, ecx
add ebx, 0x6f776fde
xor ebx, dword [0x56bf17]
rol ebx, 0x1b
neg ecx
add dword [0x56b797], edi
sub esi, ebx
call fcn.0048749b
add byte [ecx], ch
or eax, 0x56b701
Function at 0x43f989
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx], ch
or eax, 0x56b701
add ecx, 0x7e4de0b0
neg esi
add eax, dword [0x56bcb7]
not esi
ror ebx, 0x10
and dword [0x56b7f6], esi
call fcn.004e1bc9
add edx, dword [0x56bc8d]
xor dword [0x56b819], esi
inc edi
ror ecx, 0x10
add edx, 0x1eeaa477
inc edi
sub ebx, esi
call fcn.004efd9d
call fcn.0049b1cc
add ebx, esi
dec edi
sub edx, 0x1eeaa477
rol ecx, 0x10
dec edi
add dword [0x56b9c3], edx
sub dword [0x56b9f1], esi
rol ebx, 0x10
not esi
neg esi
sub ecx, 0x7e4de0b0
add dword [0x56b951], ebx
add esi, ebx
add dword [0x56b714], ebx
neg ecx
ror ebx, 0x1b
push ebx
rol eax, 4
neg esi
xchg eax, esi
neg ebx
inc edx
ror esi, 0x1b
xchg edx, esi
xor eax, dword [0x56bbfe]
not eax
or edi, dword [0x56be2f]
or ecx, dword [0x56bf4f]
call fcn.0049e8c2
call fcn.00407f11
not eax
xchg edx, esi
rol esi, 0x1b
dec edx
neg ebx
xchg eax, esi
neg esi
ror eax, 4
mov ebx, 0x5d89e
xchg edx, esi
call fcn.004228da
mov dword [0x56b8b3], ecx
xor eax, dword [0x56bbe0]
sub ecx, dword [0x56bd02]
or edi, dword [0x56bc75]
dec eax
sub edi, dword [0x56bd7f]
add edi, dword [0x56bcf8]
or ecx, dword [0x56bec0]
and dword [0x56ba67], esi
xor eax, 0x662baa3b
rol eax, 3
xor esi, edx
xor eax, 0xe463fcf0
and dword [0x56b937], edi
sub ecx, dword [0x56bd7c]
inc esi
call fcn.0047cf3d
call fcn.004c07f5
dec esi
sub dword [0x56b76a], edx
xor eax, 0xe463fcf0
xor esi, edx
ror eax, 3
xor eax, 0x662baa3b
mov dword [0x56b926], ecx
inc eax
xchg edx, esi
push ebx
or dword [0x56bad3], esi
neg eax
ror edi, 4
xor edi, 0xd9e9a418
sub edx, 0x73232903
rol esi, 0x12
and dword [0x56b763], eax
add eax, esp
not ecx
add ecx, esp
call fcn.00479692
rol ecx, 3
and dword [0x56b8b8], esi
xchg ebx, edx
inc ebx
xor edx, esi
sub edi, dword [0x56bcbc]
call fcn.00430e24
call fcn.0042f55a
call fcn.004762c8
call fcn.004a8f85
xor edx, esi
dec ebx
xchg ebx, edx
sub dword [0x56b7b0], edx
ror ecx, 3
sub ecx, esp
not ecx
sub eax, esp
or dword [0x56b84a], edx
ror esi, 0x12
add edx, 0x73232903
xor edi, 0xd9e9a418
rol edi, 4
neg eax
or dword [0x56baff], edx
mov ecx, 0x3e781f64
or ecx, dword [0x56be1b]
invalid
invalid
mov dh, 0xbc

Function at 0x43fbea
Capabilities:
Hash data using murmur3

Disassembly:
mov esi, 0x15330056
leave
mov esi, 0xfd2b0056
dec eax
not eax
call fcn.0042ad67
inc edi
neg esi
add ebx, edx
sub dword [0x56b7ae], ecx
sub dword [0x56b953], edi
sub ebx, edx
neg esi
dec edi
call fcn.0043526b
not eax
inc eax
add edi, ebp
or dword [0x56b873], ecx
add edi, 0xeff780cc
not ebx
ror esi, 0xc
xchg ecx, eax
add ecx, 0x4ad355e3
inc edx
sub dword [0x56bb0e], ecx
not edx
xor ecx, esi
sub dword [0x56b7de], eax
sub dword [0x56b962], esi
invalid
invalid
invalid