joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431828
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push esi
mov edi, eax
movzx ebx, byte [edx + 2]
mov eax, ebx
shl eax, 9
mov esi, ebx
xor eax, 0xfffffffe
mov ecx, 0x2fff6
test eax, 0x10000
mov eax, 0x3fffc
cmovne eax, ecx
shl esi, 0xa
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xb
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xc
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xd
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xe
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
mov esi, ebx
cmovne eax, ecx
shl esi, 0xf
add eax, eax
mov ecx, eax
xor esi, eax
xor ecx, 0x8005
test esi, 0x10000
cmovne eax, ecx
shl ebx, 0x10
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
movzx ecx, byte [edx + 3]
mov ebx, ecx
cmovne eax, esi
shl ebx, 9
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xa
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xb
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xc
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xd
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xe
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
mov ebx, ecx
cmovne eax, esi
shl ebx, 0xf
add eax, eax
mov esi, eax
xor ebx, eax
xor esi, 0x8005
test ebx, 0x10000
cmovne eax, esi
shl ecx, 0x10
add eax, eax
mov ebx, eax
xor ecx, eax
xor ebx, 0x8005
test ecx, 0x10000
mov esi, dword [edi + 0x1c]
cmovne eax, ebx
cmp esi, 6
jle 0x431ac3
mov dword [esp], ebp
add esi, 0xfffffffa
xor ebx, ebx
movzx ecx, byte [ebx + edx + 6]
mov ebp, ecx
shl ebp, 9
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
inc ebx
shl ebp, 0xa
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xb
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xc
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xd
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xe
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
mov ebp, ecx
cmovne eax, edi
shl ebp, 0xf
add eax, eax
mov edi, eax
xor ebp, eax
xor edi, 0x8005
test ebp, 0x10000
cmovne eax, edi
shl ecx, 0x10
add eax, eax
mov ebp, eax
xor ecx, eax
xor ebp, 0x8005
test ecx, 0x10000
cmovne eax, ebp
cmp ebx, esi
jb 0x4319e4
mov ebp, dword [esp]
mov ecx, eax
shr ecx, 8
mov byte [edx + 4], cl
mov byte [edx + 5], al
pop ecx
pop ebx
pop edi
pop esi
ret
Function at 0x439420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
sub esp, 0xc
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea ecx, [ebx - 0x3e8]
cmp ecx, 7
ja 0x4394c0
movzx eax, byte [ecx + 0x4c1b40]
add eax, 0x43944a
jmp eax
cmp ebx, 0x19a
je 0x43966c
cmp ebx, 0x1a4
je 0x43964e
cmp ebx, 0x1ae
je 0x439630
cmp ebx, 0x1b8
je 0x439612
cmp ebx, 0x1c2
je 0x4395f4
cmp ebx, 0x1cc
je 0x4395d6
cmp ebx, 0x1d6
je 0x4395b8
cmp ebx, 0x1e0
je 0x43959a
cmp ebx, 0x1ea
jne 0x439542
mov eax, ebp
mov edx, 1
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
cmp ebx, 0x1f4
jne 0x439565
mov eax, ebp
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
lea ecx, [ebx - 8]
cmp ecx, 0x138
jbe 0x439582
mov dword [ebp + 0x98], 0
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov dword [ebp + 0x98], ebx
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov edx, ebx
add esp, 0xc
pop ebp
pop ebx
jmp fcn.00439690
mov eax, ebp
mov edx, 2
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 3
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 4
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 5
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 6
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 7
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 8
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
mov eax, ebp
mov edx, 9
mov ecx, dword [esp + 0x20]
mov dword [ebp + 0x98], ebx
call fcn.00439b80
mov eax, ebx
add esp, 0xc
pop ebp
pop ebx
ret
Function at 0x45cce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push esi
push edi
push ebx
sub esp, 0x44
mov edx, dword [ebp + 8]
mov eax, dword [0x52cfb4]
xor eax, esp
mov dword [esp + 0x40], eax
mov esi, dword [ebp + 0xc]
cmp dword [edx + 0x50], 2
je 0x45d154
mov ebx, 2
mov eax, dword [esi + 0x12e0]
test eax, eax
pxor xmm0, xmm0
invalid
inc ebp
Function at 0x462f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push esi
push edi
push ebx
sub esp, 0xa24
mov esi, dword [ebp + 8]
pxor xmm0, xmm0
mov edx, dword [0x52cfb4]
xor edx, esp
mov dword [esp + 0xa20], edx
lea ecx, [esi + 0x134]
mov edx, dword [esi + 0x50]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x30], 0
lea edx, [edx + edx*8]
shl edx, 6
mov dword [esp + 0x10], edx
movdqu xmmword [esp + 0xa10], xmm0
mov edx, dword [esi + 0x78]
lea ecx, [esp + 0x34]
push ecx
push esi
mov dword [esi + 0x14b08], edx
call fcn.00464420
mov dword [esp + 0x20], eax
push esi
mov dword [esi + 0x14b08], 1
call fcn.0042d980
add esp, 0xc
mov ecx, dword [esi + 0x50]
mov edi, ecx
mov edx, dword [esi + 0x4c]
imul edi, edx
mov ebx, dword [esi + 0x1c]
shl ebx, 3
sub eax, ebx
mov dword [esp + 0x2c], edx
cdq
idiv edi
mov dword [esp + 0x38], eax
imul eax, dword [esi + 0x70], 0x3e8
imul eax, dword [esp + 0x10]
test byte [esi + 0x14c68], 1
je 0x462fef
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x4ca220]
cvttsd2si eax, xmm0
pxor xmm0, xmm0
pxor xmm3, xmm3
cvtss2sd xmm0, dword [esi + 0xf8]
cdq
idiv dword [esi + 0x44]
movsd xmm1, qword [0x4ca238]
sub eax, ebx
cdq
subsd xmm1, xmm0
idiv edi
mulsd xmm1, qword [0x4ca230]
divsd xmm1, qword [0x4ca240]
movsd xmm2, qword [0x4ca1a8]
movss xmm0, dword [0x4ca26c]
mov dword [esp + 0x34], eax
addsd xmm1, qword [0x4ca228]
cvtsd2ss xmm1, xmm1
cvtss2sd xmm3, xmm1
comisd xmm2, xmm3
ja 0x463051
movaps xmm0, xmm1
test ecx, ecx
jle 0x4635d8
pxor xmm2, xmm2
xor ebx, ebx
movss xmm1, dword [0x4ca268]
cvtsi2ss xmm2, eax
minss xmm1, xmm0
mulss xmm2, xmm1
cvttss2si edi, xmm2
mov dword [esp + 0x3c], edi
lea edi, [eax + eax*2]
mov edx, edi
shr edx, 0x1f
add edi, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
xor edx, edx
sar edi, 1
sar eax, 1
movss xmm1, dword [0x4ca270]
movsd xmm0, qword [0x4ca248]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x60], esi
cmp dword [esp + 0x2c], 0
jle 0x46316b
mov esi, dword [ebp + 0xc]
lea edi, [esp + ebx*8 + 0xa10]
mov dword [esp + 0x44], edi
xor ecx, ecx
mov edi, dword [esp + 0x60]
xor eax, eax
lea esi, [esi + ebx*8]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edx
lea edi, [edx + edi + 0x134]
mov dword [esp + 0x1c], edi
mov ebx, eax
movss xmm2, dword [esi + eax*4]
mov edx, dword [esp + 0x3c]
comiss xmm2, xmm1
jbe 0x463137
mov edi, dword [esp + 0x1c]
subss xmm2, xmm1
cvtss2sd xmm2, xmm2
divsd xmm2, xmm0
cvttsd2si edx, xmm2
cmp dword [ebx + edi + 0x12b4], 2
jne 0x463120
mov edi, dword [esp + 0x10]
cmp edi, edx
cmovge edx, edi
cmp edx, dword [esp + 0x14]
jle 0x46312c
mov edx, dword [esp + 0x14]
jmp 0x463133
xor edi, edi
test edx, edx
cmovle edx, edi
add edx, dword [esp + 0x3c]
mov edi, 0xfff
cmp edx, 0xfff
cmovge edx, edi
invalid
Function at 0x46ac8c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x30
mov esi, ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
mov edi, dword [esi + 0x6ce0]
mov ebp, dword [esi + 0x6ce8]
cmp dword [esi + 0x2448], 0
lea ebx, [edi + ebp]
je 0x46accb
lea eax, [esi + 0x244c]
push eax
push dword [esp + 0x10]
push dword [esp + 8]
call fcn.004853e0
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x46acf8
mov eax, dword [esi + 0x2438]
add eax, 0xf
mov edi, dword [esi + 0x4b98]
and eax, 0xf
mov dword [esi + 0x2438], eax
lea eax, [esi + 0x2420]
mov dword [esi + 0x4b9c], edi
jmp 0x46ad08
lea ebx, [edi + ebp + 1]
mov edi, dword [esi + 0x4b9c]
lea eax, [esi + 0x2428]
mov edx, dword [esi + 0x2438]
mov ebp, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], edx
lea ecx, [edx + 1]
mov dword [esp + 8], ecx
lea ecx, [edx*4]
mov dword [esp + 4], ecx
lea ecx, [ebp + edx*4]
test dl, 1
je 0x46ad3e
mov edx, dword [esp + 8]
and edx, 0xf
lea edx, [eax + edx*4]
jmp 0x46ad52
mov edx, dword [esp + 8]
mov ebp, eax
mov dword [esp + 0x10], edx
mov edx, ecx
mov ecx, dword [esp + 4]
lea ecx, [eax + ecx + 4]
push dword [esp]
push ecx
push edx
call fcn.00485420
add esp, 0xc
mov eax, dword [esp + 0x10]
movss xmm2, dword [0x4ca430]
movss xmm1, dword [0x4ca434]
mov dword [esp + 0x20], ebp
lea ecx, [eax*4]
mov eax, dword [esi + 0x2444]
sub eax, ecx
xor ecx, ecx
xor edx, edx
add eax, 0x40
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x4ba0]
mov dword [esp + 0x14], edx
mov edx, edi
mov dword [esp + 0x1c], ecx
mov ecx, eax
mov dword [esp + 0x24], esi
mov ebp, dword [esp + 0x28]
lea eax, [edx + ecx]
mov esi, ebx
mov edx, eax
lea ebp, [ebp + 0x40]
mov dword [esp + 0x2c], ebp
cmp eax, 0x8000
jge 0x46adca
add dword [esp + 0x20], 0x40
jmp 0x46b0f0
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
movss xmm0, dword [ebp]
movss xmm3, dword [ebp + 4]
mulss xmm0, dword [ecx]
mulss xmm3, dword [ecx + 4]
movss xmm4, dword [ebp + 8]
invalid
invalid
pop esp
Function at 0x47666c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x28
mov ebp, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov esi, dword [ebp + 0x6ce0]
mov ebx, dword [ebp + 0x6ce8]
cmp dword [ebp + 0x2448], 0
lea edi, [esi + ebx]
je 0x4766ac
lea eax, [ebp + 0x244c]
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.004853e0
add esp, 0xc
cmp dword [esp + 8], 0
jne 0x4766d9
mov eax, dword [ebp + 0x2438]
add eax, 0xf
mov esi, dword [ebp + 0x4b98]
and eax, 0xf
mov dword [ebp + 0x2438], eax
lea eax, [ebp + 0x2420]
mov dword [ebp + 0x4b9c], esi
jmp 0x4766e9
lea edi, [esi + ebx + 4]
mov esi, dword [ebp + 0x4b9c]
lea eax, [ebp + 0x2428]
mov ecx, dword [ebp + 0x2438]
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], eax
lea edx, [ecx + 1]
mov dword [esp + 0x14], edx
lea eax, [ecx*4]
lea edx, [ebx + ecx*4]
mov dword [esp + 0x10], edx
test cl, 1
je 0x476724
mov edx, dword [esp + 0x14]
and edx, 0xf
mov eax, dword [esp]
lea eax, [eax + edx*4]
mov dword [esp + 0xc], eax
jmp 0x47673d
mov ebx, dword [esp]
mov edx, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
lea eax, [ebx + edx + 4]
mov dword [esp + 0x10], eax
push dword [esp + 4]
push dword [esp + 0x14]
push dword [esp + 0x14]
mov dword [esp + 0xc], ecx
call fcn.00485420
mov ecx, dword [esp + 0xc]
add esp, 0xc
mov edx, dword [ebp + 0x2444]
lea eax, [ecx*4]
sub edx, eax
xor eax, eax
add edx, 0x40
mov dword [esp + 0xc], edx
mov dword [esp], ecx
mov edx, dword [ebp + 0x4ba0]
movss xmm1, dword [0x4ca470]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebp
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], edi
lea eax, [esi + edx]
mov esi, eax
lea ebx, [ecx + 0x40]
mov dword [esp + 0x20], ebx
cmp eax, 0x8000
jge 0x4767b3
add dword [esp + 0x18], 0x40
jmp 0x476927
mov edx, dword [esp + 0x18]
mov ebp, eax
movss xmm0, dword [edx]
movss xmm2, dword [edx + 4]
mulss xmm0, dword [ecx]
mulss xmm2, dword [ecx + 4]
movss xmm3, dword [edx + 8]
subss xmm0, xmm2
mulss xmm3, dword [ecx + 8]
movss xmm4, dword [edx + 0xc]
invalid
invalid
pop eax
Function at 0x48ac90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
endbr32
push edi
push ebx
sub esp, 0x10
mov ebx, eax
test edx, edx
je 0x48ae4a
mov edi, ecx
mov eax, ebx
and edi, 0xfff
and eax, 0xfff
neg edi
neg eax
add edi, 0x1000
add eax, 0x1000
shr edi, 4
shr eax, 4
je 0x48ada7
test edi, edi
je 0x48ad92
mov dword [esp], esi
mov esi, eax
movdqu xmm1, xmmword [ebx]
movdqu xmm0, xmmword [ecx]
movdqu xmm2, xmmword [0x4d67b0]
movdqa xmm5, xmm1
movdqu xmm3, xmmword [0x4d67c0]
pcmpgtb xmm5, xmm2
pcmpgtb xmm3, xmm1
movdqu xmm7, xmmword [0x4d67c0]
pand xmm5, xmm3
movdqu xmm6, xmmword [0x4d67b0]
movdqa xmm3, xmm0
movdqu xmm4, xmmword [0x4d67a0]
pcmpgtb xmm3, xmm6
pcmpgtb xmm7, xmm0
movdqa xmm6, xmm4
pand xmm3, xmm7
pand xmm5, xmm4
pand xmm3, xmm6
paddb xmm1, xmm5
pxor xmm2, xmm2
paddb xmm0, xmm3
pcmpeqb xmm2, xmm1
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
xor eax, 0xffff
jne 0x48ae52
pmovmskb eax, xmm2
test eax, eax
jne 0x48aeb3
add edx, 0xfffffff0
add ebx, 0x10
add ecx, 0x10
test edx, edx
jle 0x48aeb3
dec edi
dec esi
je 0x48adaa
test edi, edi
jne 0x48acda
mov eax, ecx
and eax, 0xfff
neg eax
add eax, 0x1000
jmp 0x48ada3
mov eax, ecx
and eax, 0xfff
neg eax
mov dword [esp], esi
add eax, 0x1000
xor esi, esi
jmp 0x48adcc
mov dword [esp], esi
mov esi, ebx
and esi, 0xfff
neg esi
add esi, 0x1000
test edi, edi
jne 0x48add2
mov eax, ecx
and eax, 0xfff
neg eax
add eax, 0x1000
cmp eax, esi
jbe 0x48add2
mov esi, eax
mov dword [esp + 8], edi
cmp edx, esi
jae 0x48addc
mov esi, edx
sub edx, esi
mov dword [esp + 4], edx
mov dword [esp + 0xc], esi
movzx esi, byte [ebx]
lea edx, [esi - 0x41]
cmp edx, 0x19
lea eax, [esi + 0x20]
jbe 0x48adf6
mov eax, esi
movzx esi, byte [ecx]
lea edi, [esi - 0x41]
cmp edi, 0x19
lea edx, [esi + 0x20]
jbe 0x48ae06
mov edx, esi
mov esi, dword [esp + 0xc]
cmp eax, edx
jne 0x48aebe
test eax, eax
je 0x48aeb3
inc ebx
inc ecx
dec esi
jne 0x48ade2
mov edx, dword [esp + 4]
mov edi, dword [esp + 8]
test edx, edx
je 0x48aeb3
mov esi, ebx
and esi, 0xfff
neg esi
add esi, 0x1000
shr esi, 4
je 0x48adaa
jmp 0x48ae95
xor eax, eax
add esp, 0x10
pop ebx
pop edi
ret
bsf edi, eax
mov esi, dword [esp]
cmp edi, edx
jae 0x48ae4a
pmovmskb eax, xmm2
test eax, eax
je 0x48ae6b
bsf eax, eax
cmp eax, edi
jb 0x48ae4a
movzx ebx, byte [edi + ebx]
movzx edi, byte [edi + ecx]
lea edx, [ebx - 0x41]
cmp edx, 0x19
lea eax, [ebx + 0x20]
lea ecx, [edi - 0x41]
jbe 0x48ae83
mov eax, ebx
cmp ecx, 0x19
lea edx, [edi + 0x20]
jbe 0x48ae8d
mov edx, edi
sub eax, edx
add esp, 0x10
pop ebx
pop edi
ret
mov eax, ecx
and eax, 0xfff
neg eax
add eax, 0x1000
mov edi, eax
shr edi, 4
je 0x48ada3
jmp 0x48acda
mov esi, dword [esp]
xor eax, eax
add esp, 0x10
pop ebx
pop edi
ret
mov esi, dword [esp]
sub eax, edx
add esp, 0x10
pop ebx
pop edi
ret
Function at 0x4a6661
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
and ecx, 0xfff7ffff
and eax, ecx
push esi
mov esi, dword [ebp + 8]
test eax, 0xfcf0fce0
je 0x4a6644
test esi, esi
je 0x4a6631
push 0
push 0
call fcn.004aee55
pop ecx
pop ecx
mov dword [esi], eax
call fcn.004a3cbf
push 0x16
pop esi
mov dword [eax], esi
call fcn.004a8701
mov eax, esi
jmp 0x4a665e
push ecx
push dword [ebp + 0xc]
test esi, esi
je 0x4a6655
call fcn.004aee55
mov dword [esi], eax
jmp 0x4a665a
call fcn.004aee55
pop ecx
pop ecx
xor eax, eax
pop esi
pop ebp
xor edx, 0xaf357094
xchg esp, eax
jo 0x4a669a
scasd eax, dword es:[edi]

Function at 0x4a66a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jnp 0x4a66d8
cdq
cdq
cmp eax, 0xcb0b41b5

Function at 0x4a6865
Capabilities:
Hash data using murmur3

Disassembly:
lahf
imul eax, dword [edi + 0xfc7c1c6], 0xffffffe8
pop esp
cmp ebp, 0xffffffff

Function at 0x4a6db6
Capabilities:
Hash data using murmur3

Disassembly:
out 0x57, eax
clc
dec dword [ecx]
add eax, 0x552930

Function at 0x4a75d2
Capabilities:
Hash data using murmur3

Disassembly:
mov ch, byte [ecx]
push ebp
add byte [ecx + 0x44397ef], al
lea eax, [ecx - 0x72430609]
mov ecx, eax
invalid
Function at 0x4a75ed
Capabilities:
Hash data using murmur3

Disassembly:
mov esp, 0xf7005524
sal byte [ebx], 1
int 0xb
or eax, 0x552aed
dec ecx
neg eax
or ecx, dword [0x552e0f]
or dword [0x5526e1], 0xd6afdca
push ebp
add dl, cl
std
push 0xd
neg esi
add dword [0x552670], ebx
not ebx
sub edx, dword [0x552cbf]
add ebx, 0x14df49a5
inc eax
add ebx, dword [0x552e21]
call fcn.00404576
not esi
call fcn.0044f4f3
not esi
dec eax
sub ebx, 0x14df49a5
not ebx
mov dword [0x552747], edi
neg esi
xor dword [0x55298a], 0xea9ba344
neg eax
inc ecx
xor ecx, ebp
not eax
add dword [0x552681], edi
ror esi, 0x1e
push edi
add ecx, 0xcace4a1c
xor esi, ebx
mov dword [0x55268e], eax
xor ebx, dword [0x552b93]
inc ecx
add eax, edi
sub ebx, 0xdcbec635
and dword [0x552a03], edx
sub esi, eax
xor dword [0x5527bb], ecx
add ecx, edi
call fcn.00435961
add esi, ecx
call fcn.0047b5b0
call fcn.00494756
sub esi, ecx
sub ecx, edi
add dword [0x5525a3], eax
add esi, eax
and dword [0x552667], edi
add ebx, 0xdcbec635
sub eax, edi
dec ecx
xor esi, ebx
sub ecx, 0xcace4a1c
push esp
neg esi
sub dword [0x552999], esi
xchg edx, eax
call fcn.0045bb5a
xor eax, 0x3870791
ror ecx, 0xd
sub ebx, 0x82c2472b
xor edx, dword [0x552c6d]
call fcn.0047b5b0
inc ecx
ror eax, 0xf
or ecx, dword [0x552e67]
call fcn.00462ea0
inc edi
neg esi
xchg edi, esi
or dword [0x55290d], esi
xchg edi, esi
neg esi
dec edi
call fcn.00415383
rol eax, 0xf
dec ecx
call fcn.004742dc
add ebx, 0x82c2472b
rol ecx, 0xd
xor eax, 0x3870791
call fcn.00481670
xchg edx, eax
or dword [0x55266f], edi
neg esi
push eax
not esi
inc eax
sub eax, dword [0x552bdd]
xchg ebx, edx
call fcn.00439b19
rol esi, 0x1b
xor edx, ebx
sub edi, 0x990b3dd5
and dword [0x552542], ebx
xor edi, 0x33bd6ebf
add ebx, dword [0x552e2e]
xor edi, 0x33bd6ebf
and dword [0x552928], eax
add edi, 0x990b3dd5
xor edx, ebx
ror esi, 0x1b
call fcn.0046ff92
xchg ebx, edx
dec eax
not esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, ebx
sub edi, 0x908cbc8b
and dword [0x55283d], 0xe19da82e
neg eax
sub ebx, 0x23ba43f
or edi, dword [0x552a7f]
xor dword [0x55289e], edi
xor edi, esp
inc ebx
xor ebx, dword [0x552e12]
call fcn.00459eaa
add esi, 0x5782b3eb
rol eax, 0x10
xchg ebx, esi
dec esi
xor ecx, dword [0x552f42]
call fcn.0041a30d
xor edx, 0x585bb783
call fcn.00494b20
call fcn.0043b9b2
call fcn.00468141
xor edx, 0x585bb783
call fcn.0049f41f
inc esi
xchg ebx, esi
ror eax, 0x10
sub esi, 0x5782b3eb
dec ebx
xor edi, esp
add ebx, 0x23ba43f
neg eax
add dword [0x5529a3], 0x35f62e37
add edi, 0x908cbc8b
xor eax, ebx
add esp, 0x10
xor edi, eax
inc edx
or edx, dword [0x552adc]
add ebx, dword [0x552a3a]
rol edx, 0xa
invalid
Function at 0x4a7608
Capabilities:
Hash data using murmur3

Disassembly:
mov esp, 0xf7005524
sal byte [ebx], 1
int 0xb
or eax, 0x552aed
dec ecx
neg eax
or ecx, dword [0x552e0f]
or dword [0x5526e1], 0xd6afdca
push ebp
add dl, cl
std
push 0xd
neg esi
add dword [0x552670], ebx
not ebx
sub edx, dword [0x552cbf]
add ebx, 0x14df49a5
inc eax
add ebx, dword [0x552e21]
call fcn.00404576
not esi
call fcn.0044f4f3
not esi
dec eax
sub ebx, 0x14df49a5
not ebx
mov dword [0x552747], edi
neg esi
xor dword [0x55298a], 0xea9ba344
neg eax
inc ecx
xor ecx, ebp
not eax
add dword [0x552681], edi
ror esi, 0x1e
push edi
add ecx, 0xcace4a1c
xor esi, ebx
mov dword [0x55268e], eax
xor ebx, dword [0x552b93]
inc ecx
add eax, edi
sub ebx, 0xdcbec635
and dword [0x552a03], edx
sub esi, eax
xor dword [0x5527bb], ecx
add ecx, edi
call fcn.00435961
add esi, ecx
call fcn.0047b5b0
call fcn.00494756
sub esi, ecx
sub ecx, edi
add dword [0x5525a3], eax
add esi, eax
and dword [0x552667], edi
add ebx, 0xdcbec635
sub eax, edi
dec ecx
xor esi, ebx
sub ecx, 0xcace4a1c
push esp
neg esi
sub dword [0x552999], esi
xchg edx, eax
call fcn.0045bb5a
xor eax, 0x3870791
ror ecx, 0xd
sub ebx, 0x82c2472b
xor edx, dword [0x552c6d]
call fcn.0047b5b0
inc ecx
ror eax, 0xf
or ecx, dword [0x552e67]
call fcn.00462ea0
inc edi
neg esi
xchg edi, esi
or dword [0x55290d], esi
xchg edi, esi
neg esi
dec edi
call fcn.00415383
rol eax, 0xf
dec ecx
call fcn.004742dc
add ebx, 0x82c2472b
rol ecx, 0xd
xor eax, 0x3870791
call fcn.00481670
xchg edx, eax
or dword [0x55266f], edi
neg esi
push eax
not esi
inc eax
sub eax, dword [0x552bdd]
xchg ebx, edx
call fcn.00439b19
rol esi, 0x1b
xor edx, ebx
sub edi, 0x990b3dd5
and dword [0x552542], ebx
xor edi, 0x33bd6ebf
add ebx, dword [0x552e2e]
xor edi, 0x33bd6ebf
and dword [0x552928], eax
add edi, 0x990b3dd5
xor edx, ebx
ror esi, 0x1b
call fcn.0046ff92
xchg ebx, edx
dec eax
not esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor eax, ebx
sub edi, 0x908cbc8b
and dword [0x55283d], 0xe19da82e
neg eax
sub ebx, 0x23ba43f
or edi, dword [0x552a7f]
xor dword [0x55289e], edi
xor edi, esp
inc ebx
xor ebx, dword [0x552e12]
call fcn.00459eaa
add esi, 0x5782b3eb
rol eax, 0x10
xchg ebx, esi
dec esi
xor ecx, dword [0x552f42]
call fcn.0041a30d
xor edx, 0x585bb783
call fcn.00494b20
call fcn.0043b9b2
call fcn.00468141
xor edx, 0x585bb783
call fcn.0049f41f
inc esi
xchg ebx, esi
ror eax, 0x10
sub esi, 0x5782b3eb
dec ebx
xor edi, esp
add ebx, 0x23ba43f
neg eax
add dword [0x5529a3], 0x35f62e37
add edi, 0x908cbc8b
xor eax, ebx
add esp, 0x10
xor edi, eax
inc edx
or edx, dword [0x552adc]
add ebx, dword [0x552a3a]
rol edx, 0xa
invalid

Function at 0x4a7b71
Capabilities:
Hash data using murmur3

Disassembly:
add al, ch
popal
and ebp, edi
inc dword [ecx - 0xc61c710]
mov ecx, dword [ecx - 9]
fadd dword [ecx - 0x33433316]
inc esi

Function at 0x4a7d24
Capabilities:
Hash data using murmur3

Disassembly:
dec esp
test byte [ecx - 0x326d7b3a], al
mov ah, 0xc1
retf
Function at 0x4a7d91
Capabilities:
Hash data using murmur3

Disassembly:
push esi
dec eax
rol edx, 0x16
mov dword [0x55292e], 0xecf189c3
not edx
call fcn.004058b8
add eax, esi
call fcn.004945de
xor esi, 0xd26b4bc8
xor dword [0x5524db], 0x6fbc07c0
call fcn.0046e824
xchg eax, esi
add eax, dword [0x552c60]
rol eax, 0x17
mov dword [0x5526bb], esi
rol ebx, 5
sub eax, dword [0x552a73]
ror ebx, 5
ror eax, 0x17
xchg eax, esi
call fcn.0041329c
mov dword [0x5526fc], 0x7b1cc058
xor esi, 0xd26b4bc8
call fcn.0041e230
sub eax, esi
call fcn.004497ad
invalid

Function at 0x4a7ee6
Capabilities:
Hash data using murmur3

Disassembly:
dec edi
xor esi, ebp
rol edx, 0x18
inc eax
xor ecx, 0x1347c80f
ror ebx, 0x1d
add ebx, esi
xor eax, ebx
mov dword [0x5525f1], esi
sub ecx, ebx
dec eax
or eax, dword [0x552d81]
call fcn.00423763
or dword [0x55265b], ecx
add edi, 0x358f55e9
add eax, dword [0x552ee0]
mov dword [0x552743], ecx
call fcn.0047cef8
sub dword [0x552a00], ebx
sub edi, 0x358f55e9
sub dword [0x55270b], edx
call fcn.0041be0f
inc eax
add ecx, ebx
xor eax, ebx
sub ebx, esi
rol ebx, 0x1d
xor ecx, 0x1347c80f
dec eax
ror edx, 0x18
xor esi, ebp
inc edi
neg esi
and dword [0x5524fb], edi
sub esi, 0x32fb
inc ecx
xchg esi, edx
ror ecx, 1
not edx
call fcn.004119f8
add ecx, 0x4d1dc0ab
inc eax
add dword [0x552920], esi
rol edx, 0xb
dec esi
call fcn.0041c2c9
call fcn.0042d527
inc esi
ror edx, 0xb
and dword [0x5527f8], edi
dec eax
sub ecx, 0x4d1dc0ab
call fcn.0049d035
not edx
rol ecx, 1
xchg esi, edx
dec ecx
mov edi, eax
xor ebx, 0x42e200bc
mov dword [0x5526de], ecx
not esi
call fcn.0041e6c1
sub edx, dword [0x552c4d]
xchg esi, edx
not edi
call fcn.0041d5dc
add esi, ecx
invalid

Function at 0x4ae34d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004adcbb

Function at 0x4ae358
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004adef6