joyce8/EMBER2024-capa huggingface dataset:
Function at 0x266c7
Capabilities:
Hash data using murmur3

Disassembly:
bt ebp, 0x10
add dword [ebp - 0x28], eax
ror ah, 1
add al, 0x5f
mov eax, dword [ebp - 0x1a8]
cmc
stc
cmp al, ah
add dword [ebp - 0x24], eax
ror ah, 2
shr ah, cl
mov eax, dword [ebp - 0x1ac]
bt si, bp
add dword [ebp - 0x1c], ebx
movzx bx, dl
bswap bx
add dword [ebp - 0x38], esi
shl bh, cl
sal ebx, 0x1e
add dword [ebp - 0x20], eax
shrd ebx, edx, cl
add dword [ebp - 0x40], edx
lea ebx, [edx*2 - 0x680258b]
mov word [esp + 8], si
mov byte [esp + 0x10], 0xb8
lea ebx, [edi - 0x5dc0b4f0]
mov dword [esp + 0x4c], 0
lea ebx, [edx*4 - 0x32e69dba]
dec bh
not bl
mov ebx, dword [esp + 0x4c]
mov byte [esp], ah
mov word [esp + 8], 0xbaa5
adc dword [ebp - 0x3c], ebx
mov word [esp + 8], ax
jmp 0x214a3
add dword [ebp - 0x2c], eax
bts ax, sp
shl ah, cl
mov eax, dword [ebp - 0x1a4]
pushfd
mov byte [esp + 4], ch
jmp 0x1e2bc

Function at 0x26bc7
Capabilities:
Hash data using murmur3

Disassembly:
pushal
pushfd
mov byte [esp], 0x91
mov dword [esp + 0x20], edi
call fcn.0001c278
mov byte [esp], bh
mov dword [esp], 0xead5c84e
xchg dword [esp], eax
mov al, 0x92
mov al, 0xb8
movzx ax, bl
lea eax, [ecx - 0x1c2871ba]
push dword [ecx + 4]
pushfd
pushfd
lea eax, [esi + 0x12]
mov byte [esp], 0x7d
mov dword [esp], 0x4a26610e
push 0x922e3254
mov dword [esp + 8], eax
mov byte [esp + 4], ch
jmp 0x3082d
jmp 0x3a370
pushfd
lea esp, [esp + 0xc]
call sub.ntoskrnl.exe_memcpy
and ax, 0x281b
movzx dx, bl
movzx dx, bl
mov eax, dword [ebp - 0xc]
lea edx, [ebp*8 + 0x394e91fe]
shl dx, 8
xchg edx, ecx
movzx ecx, word [eax]
btr edx, ecx
stc
sub dl, 0xb9
bsr dx, di
mov edx, edi
pushal
test dh, 0xbe
push 0x930866dd
add esp, 0x30
clc
pushfd
cmp cx, dx
push 0x1b788ea3
pushfd
lea esp, [esp + 0xc]
jae 0x1e5ef
bswap edi
mov di, 0x5d75
bswap di
movzx edi, cx
jmp 0x1e6f9

Function at 0x2739b
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pushfd
cmp ebx, dword [ebp + 0xc]
push esp
mov word [esp + 0xc], 0x5aa3
pushfd
lea esp, [esp + 0x14]
jge 0x1ce27
push 0x2796b6b6
pushfd
bt sp, 5
mov ecx, dword [ecx]
jmp 0x2ef5d

Function at 0x27b09
Capabilities:
Hash data using murmur3

Disassembly:
push 0xefa3be88
cmp ecx, esi
pushal
pushal
lea esp, [esp + 0x44]
jae 0x3b695
cmc
btr edx, ecx
seta ah
rcl dh, 1
lea eax, [ebp + ecx*4 - 0x2cc]
clc
cmc
xor di, 0xcb2f
rol edx, 9
sub esi, ecx
jmp loc.00011fe5
inc ecx
cmc
add eax, 4
sub esp, 0xffffffb4
jns 0x25348
bt esp, ecx
pushfd
cmp ecx, 0x10
pushal
lea esp, [esp + 0x24]
jb 0x3deae
stc
jmp 0x18ed4

Function at 0x282df
Capabilities:
Hash data using murmur3

Disassembly:
pushal
lea esp, [esp + 0x38]
jb 0x3f1e9
mov si, 0x2d50
shr si, 9
add esi, eax
stc
push 0x40
shl esi, 7
bswap si
stc
pop esi
cmp dl, ch
push ecx
clc
clc
cmp ecx, esi
mov byte [esp], bl
lea esp, [esp + 4]
jae 0x21a3b
ror ah, 3
shr di, 2
sub esi, ecx
bts di, dx
lea eax, [ebp + ecx*4 - 0x2cc]
push edx
mov di, word [esp]
pop edi
btr di, cx
mov dword [ebp - 0x1b0], esi
ror di, cl
pushal
mov ecx, dword [eax]
btr di, bx
jmp 0x2a9e9
cmc
mov esi, ecx
btc di, bx
pop edi
rol esi, 0xf
cmc
btr edi, esp
rcr di, 0xe
mov edi, ecx
push edx
jmp 0x13e8d
Function at 0x28727
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x54]
call fcn.00010c6e
pushfd
pushal
pushfd
mov dword [esp + 0x24], ebx
mov byte [esp + 8], dh
mov dword [esp], 0x198fff79
pushal
mov dword [esp + 0x40], 0x1388
call fcn.00035814
mov dword [ebp - 0x10], 0x69ae228a
jmp 0x20d7a

Function at 0x289b6
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
mov dword [esp + 0x38], eax
jmp 0x25948
Function at 0x28bb7
Capabilities:
Hash data using murmur3

Disassembly:
push eax
pushfd
clc
ror edi, 7
cmp dh, 0x6c
cmc
stc
test esi, eax
xor esi, edi
btc di, ax
mov edi, dword [eax]
pushfd
push dword [esp]
pushfd
shr ecx, 3
bt di, si
clc
xor esi, ecx
rcl cx, cl
jmp 0x317c7
xchg si, di
rcl si, cl
movsx esi, cl
mov esi, ecx
push 0x9add8dcb
rol di, cl
pop edi
push dword [esp + 4]
rol esi, 0xe
pushal
clc
bts di, sp
bts di, 7
mov edi, ecx
jmp 0x25169
mov ecx, dword [eax]
stc
stc
rol edi, 0xf
jmp 0x1c38c

Function at 0x28c0d
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x38]
call fcn.0002758c
bsr cx, dx
inc ch
add ecx, ecx
mov ch, bh
mov ecx, dword [ebp - 0xc]
jmp fcn.0001314c

Function at 0x28c63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x10], eax
call fcn.00011227
bt edx, ebp
test eax, eax
jmp loc.000119da

Function at 0x28ea7
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0001d079
push dword [esp]
inc esi
cmc
push edi
cmc
cmp esi, 0x10
pushfd
jmp 0x1c6ac

Function at 0x29119
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pop eax
lea eax, [esi + 0x22c]
push eax
mov dword [esp + 0x20], eax
pushfd
pushal
jmp 0x2f8bc
mov dword [esp], edx
lea esp, [esp + 0x44]
call sub.ntoskrnl.exe_memcpy
shrd ax, sp, 3
mov eax, dword [ebp + 0xc]
cmc
add esp, 0xc
jmp 0x3c049
cmp dword [eax], 1
sete al
not al
jmp loc.00011ad7

Function at 0x296df
Capabilities:
Hash data using murmur3

Disassembly:
rol edi, 0xf
jmp 0x3f93c
xor esi, ecx
clc
pushfd
pushal
bts cx, si
mov ecx, dword [eax]
cmc
jmp 0x295b2
rol ecx, 0xd
cmc
bt bp, dx
xor edi, ecx
sbb ecx, 0xc96c09b9
mov ecx, dword [eax]
bt ax, si
push 0x1f3a94ac
test al, 2
pushfd
shr ecx, 0xa
jmp 0x32748

Function at 0x2a0b9
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 4], al
cmp ch, 0x26
add esi, dword [eax - 0x38]
stc
add eax, 4
clc
add esi, dword [eax - 0x18]
call fcn.000333fa
rol edi, 0xf
pushfd
pushfd
rol ecx, 0xd
clc
cmp ax, ax
xor edi, ecx
bsf cx, sp
test cl, bh
movzx ecx, dl
mov ecx, dword [eax]
clc
shr ecx, 0xa
jmp 0x30757
xor edi, ecx
stc
call fcn.0001c555

Function at 0x2a563
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x34]
call fcn.00011ef4
push esi
call fcn.00035747

Function at 0x2a715
Capabilities:
Hash data using murmur3

Disassembly:
movzx eax, ax
pushal
jmp 0x32537
lea esp, [esp + 0x2c]
jb 0x3ce01
pushfd
push 0x18a25ce
call fcn.00010b79

Function at 0x2a968
Capabilities:
Hash data using murmur3

Disassembly:
dec esi
mov byte [esp + 4], ch
jmp 0x3f0c2

Function at 0x2a9ad
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x28]
call fcn.0003c691
stc
test bl, bl
clc
test bx, 0x973b
test eax, eax
pushal
mov byte [esp], 0x6e
pushal
call fcn.0002f69d
Function at 0x2a9cc
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
pushfd
mov dword [esp], eax
pushfd
lea esp, [esp + 4]
call fcn.00013582
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
jmp 0x3acbc
call fcn.00033078
jmp 0x127ca
test eax, 0x800
pushal
lea esp, [esp + 0x20]
jns 0x40ed2
pushfd
pushfd
lea esp, [esp + 8]
je 0x25b9c
call fcn.0002b43a
mov word [esp], 0x66c2
pushal
test al, 0x7a
push 0x4c391963
lea esp, [esp + 0x28]
jne 0x16883
jmp 0x1ea44
stc
push 0x2504ea19
clc
mov dword [ebp - 0x1bc], edi
jmp 0x3f66e
push edi
clc
cmc
mov dword [ebp - 0x1a8], eax
pushfd
setl ah
lahf
lahf
mov eax, edx
call fcn.0003b2f5
lea esp, [esp + 0x38]
call sub.ntoskrnl.exe_memset
sbb ecx, 0x7ed11c44
inc al
mov eax, dword [ebp - 0x10]
btc cx, bx
neg di
mov ecx, dword [ebp - 4]
ror dh, 7
or di, 0x70e
mov dx, sp
mov dword [esi + 0x21c], eax
rdtsc
pushfd
xchg ah, dh
movzx eax, word [ecx]
shrd dx, ax, 4
sbb di, di
movzx edi, al
test ch, 0x30
mov edi, 0x208
pushfd
sub dh, dh
pop edx
mov edx, edi
clc
mov dword [esp], edx
cmp edx, ebx
add esp, 0x10
push 0x13066b24
cmp ax, dx
call fcn.0003fbd9
call fcn.00034f63
stc
mov eax, dword [ebp - 0x24]
pushfd
stc
mov dword [ebp - 0x1a4], eax
movzx eax, cl
bts ax, 6
mov eax, dword [ebp - 0x1c]
pushfd
bt edi, 0x17
mov dword [ebp - 0x1b0], esi
jmp 0x38713

Function at 0x2abc3
Capabilities:
Hash data using murmur3

Disassembly:
bt bp, ax
clc
clc
cmp ecx, esi
pushfd
mov byte [esp], dh
push dword [esp]
lea esp, [esp + 8]
jae 0x3b695
shrd ax, dx, cl
shl al, cl
shr dl, 6
lea eax, [ebp + ecx*4 - 0x2cc]
neg bh
dec edx
inc dx
shrd di, cx, cl
sub esi, ecx
inc ecx
cmc
cmp dl, dl
add eax, 4
mov byte [esp + 0xc], 0xe6
cmp ecx, 0x10
mov byte [esp], cl
jmp 0x2cd7b
pushfd
pushfd
lea esp, [esp + 0x48]
jb 0x3deae
jmp 0x20085
Function at 0x2ac7b
Capabilities:
Hash data using murmur3

Disassembly:
btr di, dx
pushfd
bswap cx
movsx si, bl
mov ecx, dword [eax - 0x34]
bswap si
call fcn.0002a1ff
shr ecx, 0xa
test bx, sp
bt esp, 0xe
jmp loc.0001317b
call fcn.0003ba81
shr ecx, 3
bt edi, 0xf
ror ebx, 7
stc
pushfd
mov word [esp + 4], cx
xor edi, ebx
bsf bx, ax
pushfd
and bl, cl
xor edi, ecx
ror cx, cl
mov ecx, edx
push esi
bt esi, 0x10
rcl bx, 5
stc
rol ecx, 0xf
clc
mov ebx, edx
call fcn.000126e7
xor cx, 0x4910
bsf ax, dx
rol eax, cl
mov eax, dword [ebp - 0x20]
xchg di, cx
dec edi
cmp ch, 0x3a
shl cl, 5
mov dword [ebp - 0x1a4], eax
movsx ax, al
bt bp, dx
mov eax, dword [ebp - 0x1c]
sar di, cl
test bl, dl
mov dword [ebp - 0x194], ebx
call fcn.0003308b
jmp 0x2f856
mov byte [esp], bl
lea esp, [esp + 0x54]
jbe 0x292ee
dec dword [ebp - 0x1b0]
push edx
pushfd
pushal
mov dword [eax + 4], esi
jmp 0x3917a
pushal
push dword [esp + 4]
dec dword [ebp - 0x1b0]
push 0xef402b3a
mov dword [eax + 4], esi
mov byte [esp], 0x52
jmp 0x2095d
pushfd
lea esp, [esp + 0x2c]
jne 0x1d108
lea eax, [edx + 0x6f27f57c]
movsx ax, bl
clc
mov eax, dword [ebp - 0xa4]
not si
pushal
btc cx, bx
pushfd
mov esi, dword [ebp - 0xa8]
not di
mov dword [ebp - 0x198], eax
rol ch, cl
pop eax
jmp 0x3b0e7
bts ax, dx
mov eax, dword [ebp - 0xa0]
push dword [esp + 8]
mov dword [ebp - 0x1ac], eax
lea eax, [ecx - 0x43a917e3]
bswap cx
btr cx, ax
mov eax, dword [ebp - 0x9c]
rcr edi, cl
push dword [esp + 8]
call fcn.0003f4f7

Function at 0x2afe2
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0001c157
mov byte [esp], dh
mov byte [esp + 4], ch
mov byte [esp], dh
lea esp, [esp + 0x10]
jb 0x3ce01
movzx ax, al
lahf
mov eax, edi
push 0xd60ea7fe
jmp 0x1a34c

Function at 0x2b502
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
clc
ror ebx, 7
mov byte [esp + 0x10], 0x63
xor edx, ebx
call fcn.0003933f
push esi
jmp 0x2e3a8
lea esp, [esp + 0x30]
jle 0x31355
shl dx, 0xb
clc
mov edx, dword [eax + esi*8 + 0x78]
cmp bx, 0xd3c7
cmp dh, 0xdb
pushal
bt ebp, esi
cmp edx, dword [eax + 0x54]
pushfd
push dword [esp + 4]
mov byte [esp + 8], 0xd1
lea esp, [esp + 0x28]
jae 0x2c03a
jb 0x3d0ba
cmp edx, ecx
push esi
pushfd
pushfd
lea esp, [esp + 0xc]
jb 0x2c03a
pushfd
stc
pushal
cmp esi, 0xa
call fcn.00022777
push eax
shr edx, 0xa
mov byte [esp + 8], 0xd9
cmc
rol ebx, 0xd
stc
bt cx, si
jmp 0x31938
xor edi, ebx
movsx ebx, al
xor edi, edx
rcl edx, 0x17
not dl
bt cx, cx
movsx edx, al
mov edx, ecx
bt edx, 9
ror ebx, cl
cmc
rcl bh, 4
rol edx, 0xe
mov byte [esp], dl
mov ebx, ecx
stc
jmp 0x21d43

Function at 0x2b711
Capabilities:
Resolve function by parsing pe exports

Disassembly:
stc
push dword [esp]
bt si, bp
xor ecx, edx
push eax
clc
add edi, ecx
push dword [esp + 8]
clc
mov word [esp + 0xc], dx
add edi, dword [eax - 0x38]
call fcn.000196e4
bswap cx
pushal
mov ecx, dword [ebp - 8]
mov word [esp], sp
mov dword [esp + 0x1c], 0x256d8
call fcn.0002c240

Function at 0x2b7df
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x30]
jne 0x16883
jmp 0x2efdc
test al, 0x7a
pushfd
pushfd
push edi
jmp 0x1c65f
jmp 0x1bebe
Function at 0x2b93b
Capabilities:
Hash data using murmur3

Disassembly:
mov ebx, ecx
jmp 0x2677e
mov dword [ebp - 0x1b8], edx
rcr cx, 1
mov ecx, dword [eax - 0x34]
rcl bh, cl
movzx dx, al
mov edx, dword [eax]
clc
stc
push dword [esp]
stc
mov esi, ecx
rcr bx, 0xa
bts bx, 1
rcr bx, 0xa
rol esi, 0xe
jmp 0x1f3e6
cmp ecx, esi
pushal
push esi
pushfd
jmp 0x376d1
lea esp, [esp + 0x2c]
jae 0x24819
cwde
mov edx, esi
cmp al, 0xc7
sub edx, ecx
bt dx, di
mov bl, 0xfd
stc
clc
lea eax, [ebp + ecx*4 - 0x2cc]
stc
pushal
bts cx, bp
jmp 0x23476

Function at 0x2bef8
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 0x3c], eax
pushfd
call fcn.00034dbe

Function at 0x2bf02
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], dl
call fcn.0002e06a
cmc
shr ecx, 3
bt ebx, edx
pushfd
push ecx
ror ebx, 7
mov byte [esp], 0xcc
stc
bt sp, di
xor edi, ebx
cmp dh, dl
bt si, 0xe
movzx bx, cl
shrd bx, di, cl
xor edi, ecx
clc
rcl bl, 3
pop ebx
movsx ebx, al
mov ecx, edx
ror bl, 7
bswap ebx
rol ecx, 0xf
clc
rol bl, 7
mov bh, ch
mov ebx, edx
pushfd
bt cx, bp
rol ebx, 0xd
push dword [esp + 4]
clc
pushal
cmp di, si
xor ecx, ebx
clc
shr edx, 0xa
call fcn.0002b6f1
jmp 0x34809
mov esi, dword [esp + 0xc]
lea ebx, [eax*8 - 0x74aafe19]
mov ebx, dword [esp + 0x10]
mov byte [esp], 0x65
jmp 0x1f63b
movzx bx, dl
jmp 0x2af54

Function at 0x2bf0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov di, word [esp + 0xc]
bswap di
mov edi, dword [ebp - 0x1a8]
mov dword [esp], 0x616f5783
mov byte [esp], 0xe5
mov byte [esp + 0xc], 0x73
lea esp, [esp + 0x50]
jmp fcn.000379fe

Function at 0x2c93f
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x2c]
jae 0x29cf7
jmp 0x2cf78
mov byte [ebp + eax - 0xf8], pe_nt_image_headers32
clc
bt bx, dx
cmp eax, 0x38
mov word [esp + 4], di
push esp
pushal
inc eax
jmp 0x1f804
pushfd
cmp eax, 0x38
pushal
pushfd
lea esp, [esp + 0x28]
jae 0x124b0
movzx cx, al
neg dh
push 0x38
rol ch, cl
sbb dl, 0x49
xor dx, bp
cmp ah, bh
pop edx
test bl, ch
sub edx, eax
movsx ecx, al
push edx
lea ecx, [ebx*4 + 0x541b7c84]
bswap cx
lea ecx, [ebp + eax - 0xf8]
call fcn.00013b2b

Function at 0x2cbfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0xb8]
pushal
push dword [esp]
mov al, byte [ebp + eax - 0x1c4]
jmp 0x1ad0d

Function at 0x2cd73
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
stc
cmc
cmp ax, bx
xor ecx, ebx
bt bx, 9
bt eax, eax
clc
pushfd
shr edx, 0xa
jmp 0x2e134
mov ecx, dword [eax - 0x34]
jmp 0x3397c
clc
stc
bt cx, cx
xor ecx, edx
mov byte [esp], cl
push edx
add edi, ecx
cmc
call fcn.00028ccd
mov edx, dword [eax]
movzx bx, bl
movzx bx, dl
push dword [esp]
mov edi, ecx
clc
rol edi, 0xe
rcl bl, cl
mov ebx, ecx
cmc
cmp bh, 0x53
shr ecx, 3
pushfd
pushal
stc
stc
ror ebx, 7
pushfd
clc
pushfd
pushfd
xor edi, ebx
shld bx, cx, 0xc
ror bl, cl
add bl, bh
bswap bx
xor edi, ecx
movsx bx, cl
rcl cl, cl
btr cx, di
mov ecx, edx
stc
cmc
btr ebx, 0x1d
rol ecx, 0xf
bt esp, 4
bt sp, sp
mov ebx, edx
stc
stc
stc
rol ebx, 0xd
jmp 0x1f3ed
Function at 0x2d3f0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
stc
pushfd
cmp dword [ebp - 0x48], 0x40
call fcn.00026f52

Function at 0x2d3fb
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cwde
xchg cl, al
mov eax, dword [ebp - 0x1a0]
setno cl
lea ecx, [ebx*2 - 0x726477a3]
movsx cx, dl
movsx cx, dl
mov ecx, dword [ebp - 0xb8]
mov byte [esp], 0x8c
push dword [esp]
mov al, byte [ebp + eax - 0x18]
push 0xdf95a2ce
push 0xcaeb0412
jmp 0x3f79c
cwde
inc al
mov edx, 0x200
jmp 0x1fa06
mov byte [ebp + ecx - 0xf8], al
mov byte [esp], 0xc4
inc dword [ebp - 0xb8]
mov byte [esp], bh
lea esp, [esp + 0x38]
jmp fcn.0002b4fd

Function at 0x2d550
Capabilities:
Hash data using murmur3

Disassembly:
ror edi, 7
stc
xor esi, edi
pushfd
and di, 0x135e
mov edi, dword [eax]
test dl, 0xb9
clc
shr ecx, 3
cmc
xor esi, ecx
cmc
movzx ecx, bl
movsx cx, cl
btc ecx, 0x15
mov ecx, dword [eax]
bt di, 3
jmp 0x3387d
rol edi, 0xf
pushfd
pushal
rol ecx, 0xd
bt di, di
xor edi, ecx
clc
movzx ecx, cl
neg ch
cmp ah, 0x63
mov ecx, dword [eax]
clc
mov byte [esp], 0x4b
shr ecx, 0xa
jmp 0x231ad

Function at 0x2daa2
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x37739
push dword [ebp - 4]
pop dword [esp + 4]
mov dword [esp], 0x3e5d757d
pushal
jmp 0x1d71c

Function at 0x2dbb6
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp + 8], edx
jmp 0x30018
jmp 0x26fde

Function at 0x2de8f
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], cl
mov al, byte [ebp + eax - 0x18]
mov byte [esp + 4], 0xab
mov byte [ebp + ecx - 0x88], al
push dword [esp]
call fcn.0002c088

Function at 0x2deb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp + 8]
lea esp, [esp + 0x38]
jle 0x40ff5
clc
pushal
mov dword [ebp + 8], ebx
cmc
cmp dword [ebp + 8], esi
pushfd
lea esp, [esp + 0x24]
jle 0x31355
mov dl, pe_nt_image_headers32
dec edx
btr edx, 0x16
mov dh, bh
mov edx, dword [eax + esi*8 + 0x78]
push 0x34e4f1e0
mov byte [esp], 0x5a
jmp 0x1ee2d

Function at 0x2e194
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x14], eax
pushfd
pushfd
mov byte [esp + 0x10], 0xe7
lea esp, [esp + 0x1c]
jmp fcn.000202d6

Function at 0x2e59b
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp + 4], dx
pushfd
mov dword [ebp - 0x198], eax
lahf
bt dx, sp
mov eax, dword [ebp - 0x30]
pushal
mov dword [ebp - 0x19c], eax
rcr ah, cl
stc
mov eax, dword [ebp - 0x2c]
mov word [esp], 0xa499
pushfd
mov dword [ebp - 0x194], eax
stc
cmc
mov eax, dword [ebp - 0x24]
jmp 0x3c993
clc
cmc
mov dword [ebp - 0x1a4], eax
lea eax, [ebx - 0x1e99f1a]
btr ax, bp
mov eax, dword [ebp - 0x1c]
clc
pushfd
push dword [esp]
pushfd
mov dword [ebp - 0x1b0], esi
clc
mov dword [ebp - 0x1bc], edi
pushfd
mov dword [ebp - 0x1a8], eax
rcr ah, 1
setno ah
btr ax, 1
ror al, 3
mov eax, edx
pushfd
ror eax, 0xb
push edx
mov byte [esp], bh
pushfd
push 0xd0199931
lea esp, [esp + 0x50]
jmp 0x2839c
Function at 0x2e6d7
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x30]
call fcn.00016cd0
call fcn.000383e4
jmp 0x3d6bf
mov dword [esp + 0x24], 0x176e8
push 0x8bcaad3c
push ebx
pushfd
jmp 0x20ef2

Function at 0x2e710
Capabilities:
Hash data using murmur3

Disassembly:
inc esi
jg 0x3f49a
movzx esi, byte [eax - 1]
rcr di, 0xa
xor di, 0x8441
rol edi, cl
neg di
movzx edi, byte [eax]
test bh, 0x92
test ch, ah
shl esi, 8
call fcn.0003856d
jmp 0x3c832
push 0xd60380a5
mov byte [ebp + ecx - 0xf8], al
pushfd
inc dword [ebp - 0xb8]
clc
cmp dl, cl
cmc
cmp dword [ebp - 0xb8], 0x40
mov byte [esp], dh
mov dword [esp + 4], eax
mov byte [esp], 0x9c
lea esp, [esp + 0x38]
jne 0x36614
rcr di, cl
xor ecx, ecx
btc di, 0xf
sal ax, 2
sbb ah, dl
lea eax, [ebp - 0xf7]
xor si, 0xdbbb
jmp 0x24241
bsf edi, esp
not si
pushfd
movzx esi, byte [eax - 1]
bts di, cx
movsx di, cl
movzx edi, byte [eax]
call fcn.000222fd

Function at 0x2ecd1
Capabilities:
Hash data using murmur3

Disassembly:
push edi
jmp 0x3ca3b
mov dword [eax + 4], esi
mov byte [esp + 0x18], 0x8a
jmp 0x3d558

Function at 0x2ef97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
call sub.ntoskrnl.exe_memset
pushfd
push 0x936a4c9f
pushfd
lea esp, [esp + 0xc]
jmp fcn.000358b1

Function at 0x2f14e
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp + 4], dx
push 0xfeaa28f9
inc dword [ebp - 0x128]
clc
stc
mov byte [esp], 0xfe
push ecx
cmp dword [ebp - 0x128], 0x40
mov byte [esp], 0xc6
lea esp, [esp + 0x50]
jne 0x3b1c5
btc ax, 0xa
xor ecx, ecx
pushal
lea eax, [ebp - 0x167]
add edi, esi
ror si, 8
bt sp, sp
movzx esi, byte [eax - 1]
dec di
movzx di, al
sbb di, 0x69a8
mov word [esp], bx
movzx edi, byte [eax]
bt sp, si
pushfd
pushfd
test ch, 0x21
shl esi, 8
mov byte [esp + 8], 0x55
call fcn.0002beba

Function at 0x2f4b7
Capabilities:
Hash data using murmur3

Disassembly:
bts cx, bp
clc
call fcn.0003522e
push 0x1ecb81da
lea esp, [esp + 4]
jne 0x10c1e
mov dword [eax + 4], esi
push edx
mov word [esp + 8], 0x5111
mov byte [esp + 4], cl
lea esp, [esp + 0x50]
jmp 0x1b585

Function at 0x2f720
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [ebp - 0x100]
rcl cl, cl
mov dword [ebp - 0x1a4], eax
push 0xf5462e95
mov eax, dword [ebp - 0xfc]
btc cx, cx
mov dword [ebp - 0x1b8], esi
bt dx, di
rcl cl, 7
mov dword [ebp - 0x1ac], eax
movzx cx, bl
mov dword [ebp - 0x1a0], ebx
rol bl, 4
pushal
pop ebx
mov ebx, dword [ebp - 0x19c]
rcr ax, 0xc
pop ecx
rol ah, 5
mov eax, esi
mov ch, byte [esp]
movzx ecx, al
push 0x869bb3a
mov ecx, esi
call fcn.0002858d
Function at 0x2f781
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 4]
jae 0x1674c
rol ah, 6
xchg edi, ebx
bsf ax, cx
lea eax, [ebp + ecx*4 - 0x2cc]
bt dx, 0xf
inc dx
xchg dx, bx
inc bx
sub esi, ecx
bts ecx, ebp
movsx cx, bl
mov ecx, dword [eax - 0x34]
bt bp, bx
mov edx, dword [eax]
movsx edi, al
movsx di, al
push eax
xchg bx, di
mov edi, ecx
stc
rol edi, 0xe
shld bx, si, cl
mov ebx, ecx
bt ax, 9
pushal
test bl, 0x22
jmp 0x3aa6c
shr ecx, 3
bt edx, eax
call fcn.0003b765
mov byte [esp + 4], 0x6b
push eax
lea esp, [esp + 0xc]
call fcn.000156de
push 0xa80d94c5
pushfd
push eax
lea esp, [esp + 0xc]
jmp fcn.0002d8e8

Function at 0x2f7fe
Capabilities:
Hash data using murmur3

Disassembly:
bt ax, ax
movzx cx, al
mov ecx, dword [eax]
stc
clc
pushfd
rol edi, 0xf
pushfd
lea esp, [esp + 0x18]
jmp 0x24bf5

Function at 0x2f92e
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
mov dword [ebp - 0x28], esi
call fcn.0001b496
lea esp, [esp + 0x5c]
jae 0x27fe6
pushal
mov dword [ebp - 0x28], esi
pushfd
pushfd
pushfd
mov dword [ebp - 0x24], edx
call fcn.0001c675

Function at 0x2f965
Capabilities:
Hash data using murmur3

Disassembly:
mov esi, dword [ebp - 0x198]
pushfd
call fcn.0002cfcf
jmp 0x2a071
rol esi, cl
pop esi
push edi
mov esi, edx
cmc
clc
ror esi, 2
clc
stc
pushfd
mov byte [esp + 0x10], 0xba
xor ecx, esi
shl si, 0xe
ror si, cl
lea esp, [esp + 0x4c]
jnp 0x2b8fa
mov esi, dword [ebp - 0x198]
cmp ah, dl
test edi, 0x52df699b
call fcn.000318b9

Function at 0x2fc67
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push ebx
lea esp, [esp + 0x2c]
jne 0x36cb8
call fcn.00024f57
push ebx
jmp 0x3c431
pushal
dec eax
jmp 0x253a4

Function at 0x3022c
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x14]
jne 0x1ba0e
sal di, cl
bt di, bx
bt si, 3
pop edi
lea ecx, [ebx - 0x4168d6cf]
mov ecx, dword [ebp - 4]
jmp 0x1c9f5

Function at 0x302ba
Capabilities:
Hash data using murmur3

Disassembly:
cmc
pushfd
xor edi, ecx
cmp bl, al
stc
adc cl, 0x1e
rcr ch, cl
mov ecx, dword [eax]
pushal
call fcn.00019b1c
rol ecx, 0xd
cmc
jmp 0x21d08
cmc
push dword [esp + 4]
mov byte [esp], 0x42
rol edi, 0xf
lea esp, [esp + 0xc]
jbe 0x3f841
clc
pushfd
jmp 0x22097
pushal
call fcn.00022dbd

Function at 0x30309
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], ch
cwde
push dword [ecx + 4]
pop dword [esp]
movsx ax, cl
pushal
lea eax, [esi + 0x12]
call fcn.00013a82

Function at 0x30320
Capabilities:
Hash data using murmur3

Disassembly:
rol esi, 0xd
bt bp, 0xf
push dword [esp + 4]
clc
mov byte [esp + 8], 0xce
xor edx, esi
bt esi, eax
call fcn.00035d1b
ror si, 2
pushal
rol edx, 0xf
movsx esi, al
mov esi, ecx
jmp 0x28c7a