joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae9b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.0040dd4f
test eax, eax
je 0x40aef8
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.0040d431
push esi
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040d431
add esp, 0x20
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
push dword [ebp - 8]
call fcn.00451c94
pop ecx
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
leave
ret

Function at 0x40aff7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x40b038
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push 0xffffffffffffffff
push eax
push dword [ebp + 0xc]
call fcn.0040d431
add esp, 0x10
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
leave
ret

Function at 0x40b0f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0040dd4f
test eax, eax
je 0x40b1d7
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push ebx
push 0xffffffffffffffff
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
call fcn.0040d431
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
lea eax, [eax*2 + 2]
push eax
call fcn.004613ee
mov ecx, dword [ebp - 4]
mov edi, eax
lea ecx, [ecx*2 + 2]
push ecx
push ebx
push edi
call fcn.00453be0
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
add esp, 0x20
lea ecx, [ecx*2 + 2]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 4], ecx
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test edi, edi
je 0x40b1c8
test ebx, ebx
jne 0x40b1c1
push esi
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x40b1b3
mov eax, dword [ebp + 0x14]
cmp dword [eax], 1
je 0x40b18e
cmp dword [eax], 2
jne 0x40b1b3
mov eax, dword [ebp + 0x1c]
push 0
mov dword [ebp - 0xc], esi
push dword [eax]
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0040d58a
push esi
call fcn.00464400
mov ecx, dword [ebp + 0x1c]
add esp, 0x14
inc eax
mov dword [ecx], eax
jmp 0x40b1c0
push dword [ebp - 4]
push edi
push esi
call fcn.00453660
add esp, 0xc
pop esi
push edi
call fcn.004613d3
pop ecx
push dword [ebp - 8]
call fcn.00451c94
pop ecx
pop edi
mov eax, ebx
pop ebx
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
leave
ret
Function at 0x40b1f1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.0040dd4f
test eax, eax
je 0x40b27b
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push esi
push 0xffffffffffffffff
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call fcn.0040d431
mov edi, dword [ebp + 0x1c]
add esp, 0x10
cmp dword [ebp + 0x14], 1
mov eax, esi
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 8], esi
jne 0x40b240
push esi
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push ebx
call fcn.0040d431
mov esi, dword [ebp - 8]
lea eax, [edi + edi]
add esp, 0x10
test eax, eax
cmovne edi, eax
test esi, esi
push edi
cmovne ebx, esi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x40b26b
push esi
call fcn.00451c94
pop ecx
push dword [ebp - 4]
call fcn.00451c94
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
leave
ret

Function at 0x40b42f
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040dd4f
test eax, eax
je 0x40b46d
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push 0
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call fcn.0040d431
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 4]
mov esi, eax
call fcn.00451c94
pop ecx
mov eax, esi
pop esi
leave
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
leave
ret
Function at 0x40dfa6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ddd28]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4dd004]
cmp eax, 0xffffffff
jne 0x40dfe9
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 6
sbb eax, eax
inc eax
mov dword [0x4dd004], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451acd
leave
ret

Function at 0x41232a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x38]
mov dl, byte [esi + 0x34]
test edi, edi
jle 0x412363
mov ecx, dword [esi + 0x260]
push ebx
movzx ebx, dl
mov eax, ecx
shl ecx, 8
shr eax, 0x18
xor eax, ebx
xor ecx, dword [eax*4 + 0x4dd0a0]
mov dword [esi + 0x260], ecx
sub edi, 1
jne 0x412346
pop ebx
mov eax, dword [esi + 0x34]
mov byte [eax + esi + 0x58], 1
mov ecx, dword [esi + 0x38]
mov eax, ecx
sub eax, 1
je 0x4123fd
sub eax, 1
je 0x4123eb
sub eax, 1
je 0x4123ca
mov byte [ecx + esi + 0x54], 1
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x24]
mov byte [ecx + eax], dl
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
inc ecx
mov dword [esi + 0x44], ecx
mov byte [ecx + eax], dl
inc dword [esi + 0x44]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
mov byte [ecx + eax], dl
inc dword [esi + 0x44]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
mov byte [ecx + eax], dl
inc dword [esi + 0x44]
mov edx, dword [esi + 0x44]
mov cl, byte [esi + 0x38]
mov eax, dword [esi + 0x24]
sub cl, 4
mov byte [edx + eax], cl
jmp 0x412406
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x24]
mov byte [ecx + eax], dl
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
inc ecx
mov dword [esi + 0x44], ecx
mov byte [ecx + eax], dl
inc dword [esi + 0x44]
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
jmp 0x412403
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x44]
mov byte [ecx + eax], dl
mov ecx, dword [esi + 0x44]
inc ecx
mov dword [esi + 0x44], ecx
jmp 0x4123e6
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x44]
mov byte [ecx + eax], dl
inc dword [esi + 0x44]
pop edi
pop esi
pop ebp
ret
Function at 0x420b4e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push dword [ebp + 0x10]
xor edi, edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x420c25
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x420c25
lfence
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x420c25
push eax
lfence
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [ebp - 0xc]
push esi
push 0x42
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x420c25
push ebx
lfence
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x420c25
push esi
lfence
push dword [ebp - 8]
push eax
call fcn.00453660
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0x420c25
push 0x10
xor ebx, ebx
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x420c23
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
and dword [ebp - 8], ebx
push ecx
push eax
mov dword [edi], vtable.Gdiplus::Bitmap.0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
jmp 0x420c25
xor edi, edi
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x420c40
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4b765c]
call esi
and dword [ebp - 4], 0
test ebx, ebx
je 0x420c4b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4248aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4248f8
push str.C:Program_Files
push dword [ebp + 8]
call fcn.004641f0
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x426377
Capabilities:
Create http request

Disassembly:
push 0x55c
mov eax, 0x4b3354
call fcn.00451bb6
mov eax, dword [ebp + 8]
xor edi, edi
push eax
lea eax, [ebp - 0x410]
push str.https:__trillian.im_partner_install.php_state_s
push eax
call fcn.00410740
add esp, 0xc
mov dword [ebp - 0x564], 0x144
lea ecx, [ebp - 0x560]
push str.State_update_to___s_.
call fcn.00418d39
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], edi
push ecx
push eax
call fcn.00417a85
pop ecx
pop ecx
lea ecx, [ebp - 0x428]
push ecx
mov ecx, eax
call fcn.0041f2df
push str.:_d__s
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 1
call fcn.00418d39
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 2
push ecx
push eax
call fcn.00417aaf
lea ecx, [ebp - 0x428]
push ecx
push eax
call fcn.00417b2d
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x568], ecx
push ecx
mov ecx, eax
call fcn.0041f2df
push str.C:ProgrammingTrillianWindows6.5_setupmain.cpp
push edi
mov ecx, 0x4e1708
call fcn.0041fa1f
lea ecx, [ebp - 0x4c4]
call fcn.00419930
lea ecx, [ebp - 0x428]
call fcn.00406bbc
lea ecx, [ebp - 0x560]
call fcn.00419930
push edi
push edi
push edi
push edi
push str.TrillianSetup_6.5
call dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push edi
push edi
mov esi, eax
lea eax, [ebp - 0x410]
push edi
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
call fcn.00451b65
ret

Function at 0x42677f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x4ddd28]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x94], 6
sete al
xor ecx, ebp
call fcn.00451acd
leave
ret
Function at 0x451223
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
call fcn.0048951c
push 2
lea ecx, [ebp - 4]
push ecx
mov eax, dword [eax + 0x14]
push 0x22
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx eax, word [ebp - 4]
sub eax, 0x30
je 0x451262
sub eax, 1
je 0x45125d
sub eax, 1
je 0x451259
xor eax, eax
leave
ret
push 3
jmp 0x451264
xor eax, eax
inc eax
leave
ret
push 2
pop eax
leave
ret

Function at 0x45313b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45317a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45317a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45317a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45317a
cmp dword [ecx + 0x74], 0xe
jbe 0x45317a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x461174
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4c70f4
push 0x4c70ec
push 0x4c70f4
push 4
call fcn.00460ee6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4611ac
push dword [ebp + 0x10]
mov ecx, esi
call fcn.004b16d8
shl esi, 0x16
ror edx, 0x1d
shl ecx, 9
neg eax
ror esi, 0x13
xor esi, 0x287cdbe4
shl eax, 0x1e
mov edx, 0x6e9a009
inc esi
neg eax
rol edx, 0xa
mov ecx, 0x5dff66b6
and edi, dword [0x4dfaba]
xor edi, esp
add dword [0x4dd9aa], edx
rol ebx, 2
xor esi, ecx
shl esi, 0xc
sub ebx, edi
and ebx, dword [0x4de85d]
dec eax
shl eax, 0x12
mov edi, dword [0x4dda24]
ror ebx, 0x1a
loop 0x4611c8
add dword [0x4deadc], 0x3d7988f9

Function at 0x4611ff
Capabilities:
Hash data using murmur3

Disassembly:
and ecx, dword [0x4de8a9]
inc esi
call fcn.004ad5d9
ror eax, 0x18
shl eax, 0x17
add edi, eax
call fcn.0043ded9
add ecx, esi
mov ecx, 0x55574ce5
dec esp
push edi
push ebp
Function at 0x461239
Capabilities:
Hash data using murmur3

Disassembly:
mov edx, 0x8019f7db
or edx, esp
add eax, 0xbb545a38
neg edx
mov esi, esi
dec esi
sub edi, esi
xor dword [0x4dd614], ecx
test ebp, esi
jnp 0x461240
rol esi, 0xe
xor edx, esi
xchg edi, eax
loop 0x46121f
not edi
mov edi, ebp
mov ecx, 0x5d4f399f
or eax, 0x425f71a9
cmp ecx, 0xf0abe20f
je 0x46125f
sub eax, ebp
ror edx, 6
cmp ebx, 0x9c29acfe
jne 0x46126d
ror ebx, 0xa
neg edi
call fcn.004afa6c
neg eax
loop 0x46124f
not esi
mov edi, ebp
rol esi, 0x10
mov ebx, edi
or dword [0x4dd24b], esi
add ebx, 0xbb056bf3
and edi, 0x4455be6d
sub ecx, edi
push 0x4de3b3
add edx, edi
sub eax, edi
call fcn.004a846e
sub dword [0x4e2ee3], esi
dec eax
xor edx, 0x8db64cbd
ror edi, 0x14
xor eax, esp
or ebx, dword [0x4df833]
inc ebx
ror esi, 0x1c
sub eax, 0x13cc209e
add ecx, 0xf030541e
inc esi
xor dword [0x4e2fca], ebx
or edi, dword [0x4de17b]
not edx
ror edx, 0xb
call fcn.004a846e
mov ecx, 0xf338d5e4
dec esi
mov dword [0x4e2ea6], edx
inc esi
rol esi, 0x14
call fcn.004214e8
dec edx
xor ecx, esp
not eax
inc ecx
xor ecx, edx
neg ecx
ror esi, 3
xchg eax, edx
xor edi, 0xf6979c8e
dec ebx
ror ecx, 0x10
rol ecx, 0x10
inc ebx
xor edi, 0xf6979c8e
xchg eax, edx
rol esi, 3
neg ecx
xor ecx, edx
dec ecx
not eax
xor ecx, esp
inc edx
ror esi, 0x14
dec esi
sub dword [0x4e2f7e], ecx
inc esi
xor ecx, 0x7c0bae52
xor edi, 0x2dfccbc6
xor dword [0x4e2f92], edi
xor edx, esi
inc edx
call fcn.004a846e
xor dword [0x4e2f89], eax
sub edx, esi
mov dword [0x4e2ef4], edx
xor edx, 0x6d7c7cbb
sub dword [0x4e2eae], ebx
not eax
add eax, 0xb47fc435
sub eax, 0xb47fc435
not eax
xor edx, 0x6d7c7cbb
add edx, esi
sub dword [0x4e2e48], ecx
call fcn.00415886
dec edx
xor edx, esi
xor edi, 0x2dfccbc6
xor ecx, 0x8f337bf6
and dword [0x4e2f97], ebx
Function at 0x461280
Capabilities:
Hash data using murmur3

Disassembly:
mov edx, 0x8019f7db
or edx, esp
add eax, 0xbb545a38
neg edx
mov esi, esi
dec esi
sub edi, esi
xor dword [0x4dd614], ecx
test ebp, esi
jnp 0x461240
rol esi, 0xe
xor edx, esi
xchg edi, eax
loop 0x46121f
not edi
mov edi, ebp
mov ecx, 0x5d4f399f
or eax, 0x425f71a9
cmp ecx, 0xf0abe20f
je 0x46125f
sub eax, ebp
ror edx, 6
cmp ebx, 0x9c29acfe
jne 0x46126d
ror ebx, 0xa
neg edi
call fcn.004afa6c
neg eax
loop 0x46124f
not esi
mov edi, ebp
rol esi, 0x10
mov ebx, edi
or dword [0x4dd24b], esi
add ebx, 0xbb056bf3
and edi, 0x4455be6d
sub ecx, edi
push 0x4de3b3
add edx, edi
sub eax, edi
call fcn.004a846e
sub dword [0x4e2ee3], esi
dec eax
xor edx, 0x8db64cbd
ror edi, 0x14
xor eax, esp
or ebx, dword [0x4df833]
inc ebx
ror esi, 0x1c
sub eax, 0x13cc209e
add ecx, 0xf030541e
inc esi
xor dword [0x4e2fca], ebx
or edi, dword [0x4de17b]
not edx
ror edx, 0xb
call fcn.004a846e
mov ecx, 0xf338d5e4
dec esi
mov dword [0x4e2ea6], edx
inc esi
rol esi, 0x14
call fcn.004214e8
dec edx
xor ecx, esp
not eax
inc ecx
xor ecx, edx
neg ecx
ror esi, 3
xchg eax, edx
xor edi, 0xf6979c8e
dec ebx
ror ecx, 0x10
rol ecx, 0x10
inc ebx
xor edi, 0xf6979c8e
xchg eax, edx
rol esi, 3
neg ecx
xor ecx, edx
dec ecx
not eax
xor ecx, esp
inc edx
ror esi, 0x14
dec esi
sub dword [0x4e2f7e], ecx
inc esi
xor ecx, 0x7c0bae52
xor edi, 0x2dfccbc6
xor dword [0x4e2f92], edi
xor edx, esi
inc edx
call fcn.004a846e
xor dword [0x4e2f89], eax
sub edx, esi
mov dword [0x4e2ef4], edx
xor edx, 0x6d7c7cbb
sub dword [0x4e2eae], ebx
not eax
add eax, 0xb47fc435
sub eax, 0xb47fc435
not eax
xor edx, 0x6d7c7cbb
add edx, esi
sub dword [0x4e2e48], ecx
call fcn.00415886
dec edx
xor edx, esi
xor edi, 0x2dfccbc6
xor ecx, 0x8f337bf6
and dword [0x4e2f97], ebx

Function at 0x4613a0
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, ebx
ror ecx, 4
dec esi
sub eax, 0xa1f422ea
not esi
add dword [0x4e2e96], esi
xchg esi, eax
dec esi
add byte [ecx], al
xor eax, 0x4e2e78
dec ecx
call fcn.004a846e
not edi
inc esi
xor edi, eax
inc eax
sub dword [0x4e2fcf], esi
neg esi
rol ebx, 0xc
or al, 0x33
invalid

Function at 0x4613b0
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, ebx
ror ecx, 4
dec esi
sub eax, 0xa1f422ea
not esi
add dword [0x4e2e96], esi
xchg esi, eax
dec esi
add byte [ecx], al
xor eax, 0x4e2e78
dec ecx
call fcn.004a846e
not edi
inc esi
xor edi, eax
inc eax
sub dword [0x4e2fcf], esi
neg esi
rol ebx, 0xc
or al, 0x33
invalid

Function at 0x4613d0
Capabilities:
Hash data using murmur3

Disassembly:
xor ecx, ebx
ror ecx, 4
dec esi
sub eax, 0xa1f422ea
not esi
add dword [0x4e2e96], esi
xchg esi, eax
dec esi
add byte [ecx], al
xor eax, 0x4e2e78
dec ecx
call fcn.004a846e
not edi
inc esi
xor edi, eax
inc eax
sub dword [0x4e2fcf], esi
neg esi
rol ebx, 0xc
or al, 0x33
invalid

Function at 0x4613d3
Capabilities:
Hash data using murmur3

Disassembly:
dec edx
xchg ecx, edx
xchg ecx, edx
inc edx
xor edx, ebx
ror ebx, 0xc
neg esi
and dword [0x4e2e97], ebx
dec eax
xor edi, eax
dec esi
not edi
call fcn.004a846e
jo 0x4613f4
add byte [ecx + 1], al
cmp eax, 0x4e2fed
sub dword [0x4e2f82], esi
not esi
Function at 0x4613ee
Capabilities:
Hash data using murmur3

Disassembly:
jo 0x4613f4
add byte [ecx + 1], al
cmp eax, 0x4e2fed
in eax, dx
das
dec esi
add byte [ecx], ch
xor eax, 0x4e2f82

Function at 0x461400
Capabilities:
Hash data using murmur3

Disassembly:
add eax, 0xa1f422ea
inc esi
rol ecx, 4
xor ecx, ebx
push ecx
call fcn.004a846e
inc esi
sub ecx, 0x1c70b319
add dword [0x4e2f7b], 0x4c3bb1ba
xor edx, 0xf057ddab
add edi, 0x4f4f34b6
xchg eax, esi
neg edx
inc edi
xor edi, esp
inc ebx
neg ebx
add esi, ecx
sub esi, ecx
neg ebx
dec ebx
xor edi, esp
dec edi
neg edx
xchg eax, esi
sub edi, 0x4f4f34b6
xor edx, 0xf057ddab
add dword [0x4e2e9d], 0x4863e2a
add ecx, 0x1c70b319
dec esi
call fcn.004a846e
mov ecx, 0x46c58
sub ecx, esp
sub dword [0x4e2e94], edi
ror esi, 0x1f
mov dword [0x4e2f67], ebx
or dword [0x4e2eec], ebx
dec ebx
ror ecx, 2
neg eax
add edi, ecx
inc esi
inc ebx
call fcn.0041ea07
rol edi, 0x18
xor ebx, 0xf618ca56
dec ecx
rol edx, 0x11
ror edx, 0x11
inc ecx
xor ebx, 0xf618ca56
ror edi, 0x18
call fcn.0042b6c5
dec ebx
dec esi
sub edi, ecx
neg eax
rol ecx, 2
inc ebx
and dword [0x4e2f94], edx
rol esi, 0x1f
add ecx, esp
push ecx
add dword [0x4e2e9f], esi
xchg edx, esi
xor dword [0x4e2ee1], edi
ror edx, 0xc
neg esi
xor edx, ecx
neg ecx
call fcn.00435a1f
sub ecx, 0x62ab5609
neg edi
xor edi, ecx
and dword [0x4e2ec3], eax
mov dword [0x4e2e61], ecx
rol ebx, 7
call fcn.004a846e
ror eax, 6
add esi, edx
xor edx, ecx
xor edx, ecx
sub esi, edx
rol eax, 6
call fcn.0040531c
ror ebx, 7
sub dword [0x4e2f9e], ecx
mov dword [0x4e2f62], edi
xor edi, ecx
neg edi
add ecx, 0x62ab5609
call fcn.004572e6
neg ecx
xor edx, ecx
neg esi
rol edx, 0xc
add dword [0x4e2e54], ecx
xchg edx, esi
mov esi, 0x2838acda
call fcn.004a846e
invalid
invalid

Function at 0x4618dc
Capabilities:
Hash data using murmur3

Disassembly:
jnp fcn.004618dc
inc dword [ecx + 0x7d2ecdf3]
add eax, 0x4009cac1
Function at 0x463ed2
Capabilities:
Encode data using xor

Disassembly:
pop ss
xor ebp, dword [ecx + edx*4 - 0x218a06d8]
test al, 0x3e
popal
loop 0x463ee6
mov ecx, dword [eax - 0x52]
push edi
rcl byte [esi + 0x1c]
imul eax, dword [eax + 0x1b], 0xffffffb9
salc
xchg esp, eax
pop ecx
fcom qword [esi]
sbb al, 0x6b
inc eax
sbb edi, dword [ecx - 0x23a66b2a]
push ss
push esi
jns 0x463f16
in ax, 0xf9
loopne 0x463f31
xchg edi, eax
mov ebx, 0x5341b27c
or al, 0xb6
salc
adc byte [0x639234cb], dl
loope 0x463f12
aas
inc eax
rol dword [ebx], cl
pop ds
sub byte [edi], ah
or eax, 0x326d574c
inc dx
xor ah, byte [esi + 0x42]
enter 0xfffffffffffff031, 0xffffffffffffff93
test eax, 0x9b6b1765
jmp dword [ebx + 0xeb0250f]
and eax, 0x57c81221
jns 0x463f9a
pop esp
pop esi
insb byte es:[edi], dx
mov byte [0x2d66aec5], al
push es
jno 0x463fc0
add byte [edi + 0x31a42d01], bl
int3
sub al, 0xa4
pop esi
mov ch, 0xcc
out dx, eax
and al, 0xad
pop es
bound eax, qword [ebp + 0x454c2c12]
cmc
mov esi, 0x73d31d01
mov cl, 0x8b
jns 0x463fbe
arpl word [ebx], dx
imul si, ax, 0x246f
wait
scasd eax, dword es:[edi]
push 0xffffffffffffff87
adc dword [edx - 0x5107e4b6], esi
adc dword [esi - 0x51], edx
or al, 0x9d
popfd
adc dword [ebp - 0x33], esi
jne 0x463f6b
aaa
sub ch, bh
pop ds
xor dword [edi], eax
pushal
fistp dword [ecx + 0x5257292f]
loopne 0x463f9c
xor dword [esi + 0x6f], ebp
push esi
and cl, byte [ecx - 0x5fa8b7f3]
mov gs, word [edx]
popfd
xor dword [edx + ebx*8 - 0x36c1ba80], edi
inc ebp
leave
leave
ret 0xeff

Function at 0x485a73
Capabilities:
Encode data using xor

Disassembly:
ror dword [ebx - 0x16], cl
cmc
mov edx, ecx
mov eax, dword [0x89b0a0d9]
mov edi, 0x6c7d98ed
xchg edi, eax
jbe 0x485a56
push 0x30d08c17
add eax, 0x424a581c
cdq
jl 0x485a0e
fistp dword [esi]
cli
add eax, 0x4aa89945
lodsd eax, dword [esi]
aad 0x95
sbb dword [edi], esp
out dx, eax
fst dword [ebx]
adc dword [eax], 0xfffffff9
pop dword ds:[ebp + 0x30ea52f7]
dec ebp
invalid
aaa
invalid
xor al, 0x61
or eax, 0xfc74188
js fcn.00485a73
bnd jnp 0x485a21
stosd dword es:[edi], eax
mov eax, dword [0x18839d91]
in al, 0x39
test eax, 0xd2f850a
or ah, bl
stosb byte es:[edi], al
aad 0x42
mov esi, 0x4ea4ca15
push edx
cmp dword [edx + 0x12], 0x8a9c70f4
lds edx, [edi]
invalid

Function at 0x4b1280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b12ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b12ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x35014be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edx + 0x3c]
add esp, 0xfffffff4
mov eax, dword [eax + edx + 0x78]
add eax, edx
jne 0x35014d1
leave
ret
mov ecx, dword [eax + 0x18]
push ebx
push esi
mov esi, dword [eax + 0x20]
add esi, edx
dec ecx
mov dword [ebp - 0xc], ecx
push edi
xor ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
mov ecx, dword [esi + ecx*4]
add ecx, edx
movzx ebx, byte [ecx]
push 0x47
pop edi
sub edi, ebx
jne 0x3501513
mov dword [ebp - 4], 0x3507de0
sub dword [ebp - 4], ecx
cmp byte [ecx], 0
je 0x3501513
inc ecx
mov edi, dword [ebp - 4]
movzx ebx, byte [ecx]
movzx edi, byte [edi + ecx]
sub edi, ebx
je 0x35014ff
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
ja 0x350152e
test edi, edi
jne 0x35014e2
mov edi, dword [eax + 0x24]
lea edi, [edi + ecx*2]
movzx edi, word [edi + edx]
cmp edi, dword [eax + 0x14]
jbe 0x3501532
xor eax, eax
jmp 0x350153d
mov eax, dword [eax + 0x1c]
lea eax, [eax + edi*4]
mov eax, dword [eax + edx]
add eax, edx
pop edi
pop esi
pop ebx
leave
ret