joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16990
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x17ae0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [ebp - 0x114], 6
jne 0x16a06
mov eax, dword [ebp - 0x110]
cmp eax, 1
jne 0x169eb
push 2
pop eax
jmp 0x16a1f
cmp eax, 2
jne 0x169f5
xor eax, eax
inc eax
jmp 0x16a1f
cmp eax, 3
jne 0x169fe
xor eax, eax
jmp 0x16a1f
test eax, eax
jne 0x16a1c
push 3
jmp 0x169e8
cmp dword [ebp - 0x114], 5
jne 0x16a1c
cmp dword [ebp - 0x110], 1
jne 0x16a1c
push 4
jmp 0x169e8
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00016bfd
leave
ret

Function at 0x16b0a
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
add ecx, edx
mov edx, dword [ebp + 0xc]
push esi
movzx esi, word [ecx + 6]
xor eax, eax
cmp edx, esi
jg 0x16b44
movzx esi, word [ecx + 0x14]
imul edx, edx, 0x28
add esi, ecx
cmp dword [ebp + 0x10], 1
lea ecx, [edx + esi + 0x18]
jne 0x16b3b
mov eax, dword [ecx + 0xc]
cmp dword [ebp + 0x10], 2
jne 0x16b44
mov eax, dword [ecx + 8]
pop esi
pop ebp
ret 0xc

Function at 0x192ee
Capabilities:
Hash data using murmur3

Disassembly:
clc
mov ecx, edx
rcl bx, cl
lea ebx, [esi + 0x7c8f7e33]
movzx ebx, dl
rol ecx, 0xf
push dword [esp + 4]
bt ebp, edx
mov ebx, edx
push dword [esp + 0x20]
push dword [esp + 0xc]
pushfd
cmc
rol ebx, 0xd
cmp al, bl
cmp bl, dl
test bx, 0xd745
xor ecx, ebx
cmp ebx, eax
push ebp
bt sp, di
shr edx, 0xa
cmc
clc
xor ecx, edx
bt edi, 1
add edi, ecx
pushfd
add edi, dword [eax - 0x38]
stc
add eax, 4
pushfd
bt bp, 8
call fcn.000411b6

Function at 0x193c2
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
push 0xa2c8e1e5
mov byte [esp], dl
lea esp, [esp + 8]
jne 0x36cb8
bt di, bx
shrd si, ax, 2
mov esi, dword [edi + 0x14]
shl al, 1
mov eax, dword [esi]
call fcn.00020018

Function at 0x19f81
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0x8f
lea esp, [esp + 8]
jb 0x2c03a
pushal
test bl, ah
cmp esi, 0xa
mov dword [esp], esi
lea esp, [esp + 0x20]
jne 0x2c027
bswap cx
lea ecx, [edx + eax]
xor bx, ax
js 0x3c4e5
clc
shr bl, cl
mov ebx, ecx
pushfd
sub ebx, edi
test ah, 0x8d
add ebx, 4
add esp, 4
jo 0x22b3d
clc
push ecx
cmp ebx, dword [ebp + 0xc]
call fcn.0003ded5
bt di, bx
call fcn.0001fabd

Function at 0x1a2fb
Capabilities:
Hash data using murmur3

Disassembly:
pushal
push edx
dec eax
pushfd
lea esp, [esp + 0x4c]
je 0x36cb2
push esp
push ebx
push edi
dec eax
pushal
lea esp, [esp + 0x2c]
jne 0x36cb8
sub esi, 0xc27e4c62
mov esi, dword [edi + 0x14]
jmp 0x372ca
shl ah, 1
mov eax, dword [esi]
call fcn.0002a9cc

Function at 0x1a491
Capabilities:
Hash data using murmur3

Disassembly:
btr ebx, 0xe
mov eax, dword [ebp - 0x34]
cmc
cmp ecx, esi
jmp 0x37dd0
lea esp, [esp + 4]
jae 0x1674c
not dx
bsr eax, esi
shld edx, edi, cl
lea eax, [ebp + ecx*4 - 0x2cc]
xadd bx, di
sub esi, ecx
call fcn.0001d06f
Function at 0x1a4de
Capabilities:
Hash data using murmur3

Disassembly:
push dword [esp]
lea esp, [esp + 0x28]
jae 0x24819
sar dh, cl
mov edx, esi
xor bh, al
cmp dx, 0x90bf
shld ax, ax, cl
sub edx, ecx
bts ax, 1
bts ax, sp
not ax
pushfd
lea eax, [ebp + ecx*4 - 0x2cc]
xchg ch, bl
mov dword [ebp - 0x1b8], edx
pushfd
mov ecx, dword [eax - 0x34]
jmp 0x2eb17

Function at 0x1a909
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 0x28], ebx
stc
add ecx, edx
bts bx, cx
and dh, 0xc4
movsx bx, bl
mov edx, dword [eax + 0x74]
mov word [esp + 4], cx
mov dword [esp + 0x24], 0x10
rcl bh, cl
rol bh, cl
shld bx, dx, cl
movsx bx, cl
sub ecx, edi
bts bx, ax
mov ebx, dword [esp + 0x24]
mov byte [esp], ch
clc
cmp edx, ebx
pushfd
call fcn.00013b45

Function at 0x1a94d
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x3c]
jne 0x214b3
xadd eax, esi
xor ecx, ecx
bsr si, cx
bsf esi, ebp
aam 0x46
lea eax, [ebp - 0x87]
cmc
push ecx
movzx esi, byte [eax - 1]
neg edi
bsf di, bp
inc di
movzx edi, byte [eax]
pushfd
jmp 0x24d2f

Function at 0x1ac92
Capabilities:
Hash data using murmur3

Disassembly:
or edx, ebx
pushal
mov dword [ebp + ecx*4 - 0x2c4], edx
mov byte [esp], 0x6c
inc ecx
pushfd
add eax, 4
push 0x9e1ecda
jmp 0x1e8c7
mov byte [esp + 0xc], 0x71
pushfd
pushfd
lea esp, [esp + 0x38]
jb 0x1e9be
jp 0x2f483
clc
cmp ecx, esi
call fcn.000246c1
cmp ecx, 0x10
jmp 0x1b8df
bt si, 1
cmc
push ecx
cmp ecx, esi
call fcn.0003e205

Function at 0x1ae85
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [eax - 0x34]
bswap ebx
movsx ebx, bl
bts bx, di
mov edx, dword [eax]
setno bl
btc bx, dx
ror ebx, 7
rcl bh, 1
mov esi, ecx
jmp 0x1c0bf
rol esi, 0xe
bt si, 0xb
bsf bx, dx
mov ebx, ecx
pushfd
shr ecx, 3
cmc
bt ebx, edi
push 0x1505839
lea esp, [esp + 0x34]
jle 0x3eadf
ror ebx, 7
bt ebx, ebx
jmp 0x2c8e1
rcl bl, 1
mov ecx, edx
bt di, 2
jmp 0x300fe
stc
cmp ax, 0xcdcd
xor esi, ebx
btr bx, di
sbb bl, 0x64
mov bh, 0xfa
xor esi, ecx
movzx cx, bl
sets bl
jmp 0x28145
clc
setb bl
rol ecx, 0xf
bt sp, 0xc
btc bx, 2
mov ebx, edx
push esp
bt esp, ecx
rol ebx, 0xd
bt esi, 0x11
pushal
xor ecx, ebx
call fcn.0002def2
pushal
lea esp, [esp + 0x20]
jb 0x228fd
lahf
bswap eax
setnp cl
bswap ax
mov dword [ebp - 0x1b4], ebx
movzx cx, al
jmp 0x316a8
not ax
call fcn.00040c12
jmp 0x3d577
pushfd
pushfd
div ecx
setno cl
bswap ax
inc dword [ebp - 0x68]
or ecx, 0x4f50887f
movzx ax, al
mov eax, dword [ebp - 0x68]
push dword [esp + 0x18]
cmp eax, dword [ebp + 0x10]
not ch
pushfd
mov ecx, edx
push eax
pushfd
mov byte [esp], 0x2e
call fcn.0001efa5

Function at 0x1b11f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xb0bc6705
mov edi, 0x208
push dword [esp]
mov edx, edi
clc
pushfd
add esp, 0x40
cmc
test esi, eax
push 0x36d02255
pushal
cmp ax, dx
call fcn.0002b68a

Function at 0x1b20e
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], ebx
pushfd
push edx
mov dword [esp + 4], 0x4709c316
lea esp, [esp + 8]
call fcn.0002758c
pushfd
call fcn.0002daa2
Function at 0x1b50d
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pushfd
jmp 0x254bb
mov dword [ebp - 0xc], eax
pushfd
mov byte [esp], 3
lea esp, [esp + 0xc]
ja 0x12ceb
push 0xd88d2490
lea esp, [esp + 4]
jne 0x1b53a
stc
pushfd
clc
and dword [ebx], 0xfffffbcc
sub esp, 0xfffffffc

Function at 0x1b61b
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x28]
jae 0x1674c
daa
lea eax, [ebp + ecx*4 - 0x2cc]
pushfd
sub esi, ecx
lea esp, [esp + 4]

Function at 0x1b8fe
Capabilities:
Hash data using murmur3

Disassembly:
pushal
sub ebx, edi
push edi
push 0x676da73c
cmc
bt di, ax
add ebx, 4
call fcn.0003cd8f

Function at 0x1b93c
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], 0x86
call fcn.000293bf
clc
cmp ecx, esi
push edi
pushfd
lea esp, [esp + 8]
jae 0x3467c
dec di
xor ax, 0x55f1
aaa
sub esi, ecx
lea edi, [edi - 0x3119c742]
lea eax, [ebp + ecx*4 - 0x2cc]
btr edi, esi
clc
mov dword [ebp - 0x1b0], esi
pushal
rcl cx, 6
ror ch, 3
mov ecx, dword [eax - 0x34]
bt sp, sp
mov esi, ecx
movzx di, cl
rol esi, 0xe
mov di, word [esp + 8]
cmc
btc di, bx
movsx di, bl
mov edi, ecx
pushfd
ror edi, 7
jmp 0x1c187
pushfd
cmp ax, 0x4171
xor esi, edi
shr di, cl
movsx di, dl
sar di, cl
or di, 0x5c2b
mov edi, dword [eax]
mov dword [esp + 0x10], eax
push dword [esp + 8]
shr ecx, 3
cmp dh, 0x3c
xor esi, ecx
movsx cx, al
rcl ch, 5
btr ecx, 0xd
movzx cx, bl
mov ecx, dword [eax]
stc
rol edi, 0xf
push dword [esp]
pushfd
push dword [esp]
lea esp, [esp + 0x38]
jmp 0x24bf5

Function at 0x1ba44
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [ebp - 0x1a0], edi
call fcn.0002a31b

Function at 0x1ba4f
Capabilities:
Hash data using murmur3

Disassembly:
rcr edi, 0x1b
xchg si, di
btc si, 0xf
mov esi, ecx
jmp 0x3f335
cmc
ror di, 5
btc edi, 8
jmp 0x3da12
cmc
pushfd
add esi, dword [eax - 0x38]
test cl, 8
clc
cmc
add eax, 4
call fcn.0001a17e
shr ecx, 0xa
mov word [esp], cx
lea esp, [esp + 4]
ja 0x3ef45
pushal
xor esi, ecx
mov cx, 0x29d6
movsx ecx, al
mov ecx, dword [eax - 0x34]
push dword [esp + 4]
stc
rol edi, 0xe
jmp 0x39106
clc
ror ecx, 7
pushfd
xor edi, ecx
bts cx, 8
inc cx
shr cl, 5
shl cx, cl
mov ecx, dword [eax - 0x34]
cmp sp, sp
clc
shr ecx, 3
cmc
bt esp, 0x1e
stc
cmp ah, 0x97
xor edi, ecx
mov word [esp + 0x1c], dx
add esi, edi
jmp 0x24214
mov edi, ecx
pushal
push dword [esp + 4]
rol edi, 0xd
pushfd
push 0xb241846d
jmp fcn.0001be9a
mov dword [esp], 0xb0b30dd2
bswap di
push edi
rol esi, 0xf
rcr di, 8
btc edi, 0x18
lea esp, [esp + 0x10]
jns 0x221aa
bts di, 0xa
mov edi, ecx
clc
rol edi, 0xd
pushfd
cmp al, 0x92
xor esi, edi
lea edi, [esi - 0x5adf75a9]
shl di, cl
stc
bsr di, cx
mov edi, dword [eax - 0x34]
jmp 0x28b81

Function at 0x1c6a2
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
jmp 0x2dc4c
pushfd
mov byte [esp], 0x87
stosb byte es:[edi], al
pushal
lea esp, [esp + 0x2c]
jb 0x30fcf
call fcn.00010c5d
cmc
cmp dword [ebp - 0x1a0], edi
pushfd
call fcn.00030d73
clc
neg di
sub cl, cl
aam 0xb3
mov eax, 0xc000000d

Function at 0x1d5bd
Capabilities:
Hash data using murmur3

Disassembly:
clc
bt ax, 1
and esi, dword [ebp - 0x194]
jmp 0x1a3f3
Function at 0x1d75b
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp], edi
pushfd
jmp 0x2a38c
movsd dword es:[edi], dword [esi]
pushfd
movsd dword es:[edi], dword [esi]
mov byte [esp + 0x30], 0x62
push edx
call fcn.0001d922

Function at 0x1d83a
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x2c]
call sub.ntoskrnl.exe_memcpy
adc ax, ax
lahf
mov eax, dword [ebp - 0xc]
cmp dh, 0x30
or dh, 0xad
movzx ecx, word [eax]
bswap dx
sub dh, al
btc dx, di
mov edx, edi
test dx, ax
cmc
pushfd
bt eax, 0x16
add esp, 0x10
call fcn.0002ead3

Function at 0x1d95b
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x2c]
jb 0x34c7b
xor si, 0xc72f
mov si, cx
push 0x40
movzx esi, bl
neg si
mov si, 0x5302
cmc
pop esi
cmc
cmp edx, 0x9cd7d779
pushal
push ebp
cmp ecx, esi
mov byte [esp], 0x59
push 0x1aae566b
mov byte [esp], ch
push ebx
lea esp, [esp + 0x2c]
jae 0x2130e
xchg edi, eax
aaa
sub esi, ecx
jmp 0x3371d
cmp ecx, 0x10
pushfd
pushfd
jmp 0x3499b
bts di, 8
lea eax, [ebp + ecx*4 - 0x2cc]
lea edi, [edx*2 + 0xc15f333]
rol cx, 2
lea edi, [ecx - 0x38e5854c]
clc
mov dword [ebp - 0x1b0], esi
stc
rcl edi, cl
mov ecx, dword [eax - 0x34]
bts si, di
call fcn.00022ed2
mov esi, dword [esp + 0x20]
lea eax, [edx + 0x346e6d89]
mov dword [ebp - 0x48], esi
lea eax, [eax + 0x67d7d3d8]
push dword [esp + 8]
bswap ax
mov dword [ebp - 0x44], ebx
pop eax
lahf
mov ah, 0xd7
mov dword [ebp - 0x3c], 0x200
not al
lahf
cwde
bswap ax
mov dword [ebp - 0x40], ebx
not eax
lea esp, [esp + 0x24]
jnp 0x13b85
lea eax, [eax - 0x2ac7aa72]
not ax
mov dword [ebp - 0x38], ebx
sete ah
jmp 0x3d38b
jmp 0x1b3bc
pushfd
movsx ax, bl
mov dword [ebp - 0x34], ebx
mov word [esp], sp
call fcn.00036f8b
mov dword [ebp - 0x28], eax
pushfd
call fcn.0002e2b5
pushfd
mov esi, dword [ebp - 0x38]
bts cx, sp
pushal
mov dword [ebp - 0x198], eax
lea esp, [esp + 0x24]

Function at 0x1dafb
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x2c]
jne 0x16883
call fcn.0003fc9e

Function at 0x1e059
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp], 0x38af
call fcn.000351e9

Function at 0x1e064
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [ebp - 0xc0], al
bt esi, esp
setno al
ror ah, 1
jmp 0x36560
sets cl
mov ecx, edx
pop edi
rol ecx, 0xf
rol di, 6
pop edi
lea esp, [esp + 0x2c]
ja 0x32148
mov edi, edx
cmc
pushfd
jmp 0x23bc3
and si, 0xdc0c
neg si
jmp 0x195a5
rol edi, 0xd
call fcn.0003169f
cmc
shr edx, 0x10
stc
shr esi, 0x18
stc
bt cx, 2
bt bp, si
cmc
shr eax, 0x18
mov byte [esp], dh
mov byte [esp + 4], 0x87
mov byte [esp], 0x32
mov byte [esp + 4], dl
lea esp, [esp + 0x54]
jmp 0x22df1
pushal
rol edi, 0xd
cmp bl, 0x80
mov byte [esp], dl
xor ecx, edi
stc
pushfd
bt cx, 2
shr edx, 0xa
pushfd
xor ecx, edx
bt sp, di
push dword [esp + 4]
pushfd
add esi, ecx
cmc
mov byte [esp + 4], 0xa7
pushfd
add esi, dword [eax - 0x38]
call fcn.00036998
clc
movzx di, dl
mov edi, edx
jmp 0x26029
mov byte [ebp - 0xbf], dl
pushal
and dx, 0xaf46
rcl ax, cl
sbb dh, 0x76
lea eax, [ebp - 0xf7]
add esp, 0x20
Function at 0x1e44d
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
jb 0x2c03a
push ebx
cmp bl, dl
pushfd
cmp esi, 0xa
push 0x483ddbc5
mov byte [esp], ah
lea esp, [esp + 0xc]
jne 0x2c027
bsf bx, si
pushfd
cmc
lea ecx, [edx + eax]
call fcn.00028dff

Function at 0x1e5f5
Capabilities:
Hash data using murmur3

Disassembly:
sal si, 0xe
mov esi, dword [ebp - 0x19c]
jmp 0x2f83f
bt ecx, 0x14
clc
mov dword [ebp - 0x1a4], esi
clc
mov esi, dword [ebp - 0x1b8]
call fcn.0002067d

Function at 0x1ebbe
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 0x48], esi
call fcn.0003d60d

Function at 0x1ee8f
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp], 0x4653
mov dword [esp + 4], esi
jmp 0x22f1b
push dword [esp + 4]
mov dword [esp + 0x20], esi
call fcn.00023b00
pushal
push 0x62543652
lea esp, [esp + 0x28]
call fcn.00013f58
bt ax, ax
pushfd
push edx
cmp cx, 0xb264
test eax, eax
pushal
mov byte [esp], 0x14
mov byte [esp], cl
lea esp, [esp + 0x28]
jne 0x2c2de
clc
pushal
push ecx
cmp esi, dword [0x17b78]
lea esp, [esp + 0x24]
jno 0x2455a
je 0x27d5c
jmp 0x34180
push 0xd406040c
jmp 0x402d6
pushal
jmp 0x22af8
pushfd
pushfd
lea esp, [esp + 0xc]
je 0x27d5c
jmp 0x395c5

Function at 0x1f30e
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x48]
jne 0x214b3
pushal
or si, 0x6a12
aaa
bts eax, 0x13
sub ecx, ecx
test bp, 0x4d2e
lea eax, [ebp - 0x87]
bswap di
xor si, 0x2445
sar si, cl
btc edi, 0x14
movzx esi, byte [eax - 1]
shrd edi, eax, 0x19
ror edi, cl
movsx di, cl
movzx edi, cl
movzx edi, byte [eax]
mov word [esp + 4], 0xa132
shl esi, 8
test bp, dx
mov word [esp], 0xbf8b
bt edi, eax
push esp
or esi, edi
bts di, di
pushfd
movzx edi, byte [eax + 1]
call fcn.0001d0dc

Function at 0x1f4eb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x4c]
call sub.ntoskrnl.exe_memset
pushfd
mov byte [esp], 0x8e
pushal
pushal
lea esp, [esp + 0x44]
jmp fcn.000358b1

Function at 0x1f627
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edx
push eax
lea esp, [esp + 0x10]
jge 0x1ce27
jmp 0x3ca48
sub ebx, edi
mov byte [esp], dh
mov byte [esp], ah
add ebx, 4
mov word [esp], dx
jmp 0x3e7fd
mov ecx, dword [ecx]
test ch, 0x83
jmp 0x3ddfb
test ecx, ecx
push 0x782b8873
lea esp, [esp + 4]
jne fcn.0002c035
call fcn.0001ccf4
cmp ebx, dword [ebp + 0xc]
pushfd
jmp 0x1c088

Function at 0x1fc03
Capabilities:
Hash data using murmur3

Disassembly:
shr ecx, 3
mov byte [esp], 0x20
bt di, sp
stc
ror ebx, 7
call fcn.0002d908
pushfd
pushal
pushal
mov dword [esp + 0x40], 0
push ebx
jmp 0x33bf7
push dword [ebp - 0xc]
pop dword [esp + 0x40]
call fcn.0003b2f0

Function at 0x1fc3a
Capabilities:
Hash data using murmur3

Disassembly:
clc
xor esi, ebx
rol bh, cl
movsx bx, al
add bx, 0x399b
lea ebx, [ebp*2 - 0x13f4661c]
xor esi, ecx
btr ecx, eax
pushfd
bts ebx, 0xd
mov ecx, edx
btc bx, 7
rol ecx, 0xf
bswap bx
mov ebx, edx
mov dword [esp], 0xf1dd0346
mov word [esp], di
rol ebx, 0xd
call fcn.00016858
Function at 0x1ff94
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
lea edi, [0x1ea264a8]
mov edi, dword [ebp - 0x1a8]
push 0xc7c21232
pushfd
pushal
push dword [esp]
lea esp, [esp + 0x34]
jmp fcn.000379fe

Function at 0x1fffb
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x314f6
jmp 0x2748b
xor edi, ecx
rcr ch, 5
not cl
sbb cx, di
shr cl, 2
mov ecx, dword [eax]
jmp 0x39845
shr ecx, 0xa
cmc
xor edi, ecx
bt cx, sp
push 0xde33e1f7
add esi, edi
bt ecx, 0xf
jmp 0x1d829

Function at 0x2022e
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x54]
jne 0x3b1c5
sal si, 0xf
not ax
cmc
xor ecx, ecx
add ah, 0x31
daa
lea eax, [ebp - 0x167]
test cl, 0x65
shr si, 0xa
rol si, cl
movzx esi, byte [eax - 1]
rcl di, cl
xor di, si
dec edi
sbb edi, 0xdb581fd3
movzx edi, byte [eax]
stc
push 0x6cbda748
shl esi, 8
pushfd
stc
or esi, edi
movzx di, al
rol di, 9
pushal
movzx edi, byte [eax + 1]
jmp loc.00011a19

Function at 0x20f00
Capabilities:
Hash data using murmur3

Disassembly:
cmc
add eax, 4
cmc
call fcn.0001158c
jmp 0x32e75

Function at 0x214b8
Capabilities:
Hash data using murmur3

Disassembly:
push dword [esp]
jmp 0x3a7fe
call fcn.000258de
jmp 0x40fb1
jno 0x32a58
pushfd
mov dword [esp], ebx
push dword [ebp - 0x20]
pop dword [esp]
jmp 0x348e9
lea esp, [esp + 8]
jno 0x3951d
push dword [eax]
jmp 0x36b7b
pushfd
push dword [eax]
pop dword [esp]
pushfd
mov dword [esp], ebx
jmp 0x39f74

Function at 0x21623
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x3a6a8
call fcn.000213d7
add eax, 4
test ah, bl
stc
add esi, dword [eax - 0x18]
push 0x58bb1e48
mov dword [esp], ebp
dec dword [ebp - 0x1b0]
jmp 0x35502

Function at 0x21fd4
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
jmp 0x3c5b2
rol edi, 0xa
stc
xor ecx, edi
mov word [esp], ax
push dword [esp]
stc
mov edi, esi
cmc
ror edi, 2
cmp ah, 0xe8
bt ax, 1
test ah, 0xfc
clc
xor ecx, edi
xor di, dx
not di
bsr di, si
bts di, 8
mov edi, dword [ebp - 0x198]
stc
cmc
mov byte [esp], cl
clc
xor edi, esi
clc
cmc
and edi, dword [ebp - 0x19c]
mov word [esp + 8], 0x90f4
pushfd
and ebx, esi
pushfd
xor edi, ebx
rcr ebx, 6
mov ebx, dword [ebp - 0x1ac]
jmp 0x30edc

Function at 0x22193
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
bswap ebx
mov ebx, dword [esp + 0x14]
call fcn.0001c3d2

Function at 0x221a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
jmp 0x3884d
mov dword [esp + 4], 0
pushal
push dword [esp]
mov dword [esp + 0x24], esi
mov byte [esp + 4], cl
pushal
lea esp, [esp + 0x44]
call sub.ntoskrnl.exe_memset
mov dword [esp + 8], edi
mov word [esp], 0xed60
jmp 0x35893
Function at 0x22777
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x6ea6236b
mov byte [esp + 0x1c], ah
lea esp, [esp + 0x2c]
jne 0x2c027
setg bh
bsf cx, si
not cx
lea ecx, [edx + eax]
shl ebx, 0xd
mov bh, 4
stc
mov ebx, ecx
push 0x4e58c0b2
sub ebx, edi
cmc
jmp 0x2db63
jmp 0x2089f
push 0x6f901688
test eax, 0x37efe065
add ebx, 4
pushal
pushfd
stc
clc
cmp ebx, dword [ebp + 0xc]
push dword [esp + 4]
lea esp, [esp + 0x30]
jge 0x1ce27
pushfd
mov ecx, dword [ecx]
stc
mov dword [esp], 0xde9ed7f1
stc
test ecx, ecx
pushal
mov byte [esp + 0xc], dl
lea esp, [esp + 0x24]
jne fcn.0002c035
movsx cx, al
mov ecx, dword [eax + 0xcc]
push ecx
lea esp, [esp + 4]
jmp fcn.0002c035

Function at 0x2279f
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0xc]
jb 0x3deae
test bx, 0xc0ad
pushal
cmp si, 0x18d7
cmp ecx, esi
mov byte [esp], dh
mov byte [esp], 0xc6
lea esp, [esp + 0x20]
jae 0x3b695
xadd ah, dh
shrd ax, cx, 7
lea eax, [ebp + ecx*4 - 0x2cc]
sar bl, cl
stc
sub esi, ecx
movsx cx, bl
not ecx
clc
je 0x1c4d2
mov edx, dword [eax]
bts ebx, 9
bswap di
movsx cx, bl
mov ecx, dword [eax - 0x34]
btr di, 0xc
lea edi, [ecx*8 + 0x3740f9b8]
mov edi, edx
ror bl, cl
rol edi, 0xf
cmp dl, dl
sar bl, 6
mov ebx, edx
jmp fcn.00010c28

Function at 0x22da5
Capabilities:
Hash data using murmur3

Disassembly:
inc dword [ebp - 0x1b4]
push 0xde1f7b4b
cmp dword [ebp - 0x1b4], 8
pushfd
jmp 0x3faed
lea esp, [esp + 0x2c]
jne 0x1a1ba
pushal
add ax, cx
dec al
mov eax, dword [ebp - 0x128]
stc
cmp dx, bp
pushal
mov byte [ebp + eax - 0x168], pe_nt_image_headers32
cmp bp, 0xe7b9
cmp eax, 0x38
pushfd
call fcn.0002ed27
mov word [esp + 4], 0xed6a
mov byte [esp], 0xd0
lea esp, [esp + 0x50]
jb 0x37d44
pushal
mov byte [esp + 8], bl
push dword [esp]
pushfd
dec dword [ebp - 0x1b8]
push dword [esp]
jmp 0x28c28

Function at 0x23cad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp + esi - 0x14], al
call fcn.0003be5a
cmc
cmc
ror ecx, 0xd
push 0x9f7d259f
call fcn.000333ff

Function at 0x2409b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x58]
jb 0x2fad9
jmp loc.000129ad

Function at 0x24179
Capabilities:
Hash data using murmur3

Disassembly:
jmp 0x3efed
mov dword [ebp - 0x30], eax
lahf
mov byte [esp + 0xc], 3
lea eax, [edi - 0x10db0d05]
bswap ax
mov dword [ebp - 0x2c], ebx
lea eax, [edi*4 + 0x1c55572e]
not al
movsx eax, cl
pushal
lea eax, [ebp - 0x30]
call fcn.0003fbc2
movzx ecx, word [eax]
btc dx, di
neg edx
btr edx, 0x10
mov edx, edi
mov byte [esp + 8], bh
add esp, 0x2c
test si, sp
push 0x25f4997d
cmp cx, dx
jmp 0x215f5
pushal
lea esp, [esp + 0x24]
jae 0x1e5ef
pushfd
push dword [esp]
pushfd
pushfd
lea esp, [esp + 0x10]
jmp fcn.0002a810
Function at 0x242db
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 8], 0xa724e28f
mov dword [esp], 0x60ccf606
ror ebx, 7
mov byte [esp], 0xd8
push eax
xor esi, ebx
or bh, dh
shl bx, cl
xor bx, ax
xor esi, ecx
bts cx, 0xa
mov ecx, edx
movsx bx, al
ror bx, 0xd
movzx bx, al
rol ecx, 0xf
pop ebx
bt edx, esp
mov ebx, edx
pushfd
rol ebx, 0xd
cmc
pushfd
xor ecx, ebx
cmc
cmc
cmc
push edx
shr edx, 0xa
mov byte [esp + 4], bl
bt sp, 4
xor ecx, edx
bt bx, 1
clc
add esi, ecx
cmc
jmp 0x22cce
add esi, dword [eax - 0x38]
test dh, 0xaf
jmp 0x2c857
shr ecx, 3
jmp 0x21994
cmp cl, bl
cmc
add eax, 4
push esi
cmc
push dword [esp + 4]
clc
add esi, dword [eax - 0x18]
push edi
dec dword [ebp - 0x1b8]
call fcn.0002ecd1
Function at 0x246c1
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
jmp 0x2ca4f
push esi
lea esp, [esp + 0xc]
jae 0x24819
xchg dx, bx
add dh, dl
mov edx, esi
shrd ax, si, cl
jmp 0x2361e

Function at 0x24742
Capabilities:
Hash data using murmur3

Disassembly:
cmp dword [ebp - 0x48], 0x40
mov word [esp], 0x4db3
lea esp, [esp + 0x28]
jne 0x214b3
das
sub ecx, ecx
or ah, 0x86
btr ax, 5
lea eax, [ebp - 0x87]

Function at 0x2480f
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x5c]
jne 0x23640

Function at 0x2487f
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp + 4], si
lea esp, [esp + 0x64]
jne 0x200ba
rdtsc
movzx ax, cl
not bl
bswap edx
mov eax, dword [ebp - 0xa4]
movsx dx, dl
lea ebx, [eax*4 - 0x4e24263a]
mov ebx, dword [ebp - 0xa8]
movsx dx, bl
setle dh
mov dl, ah
pushfd
mov edx, dword [ebp - 0x98]
push 0x79697c25
pushfd
push 0x2eaf6102
mov dword [ebp - 0x198], eax
pushfd
lea eax, [eax*2 - 0x51407f5d]
mov eax, dword [ebp - 0xa0]
mov dword [esp + 4], 0x9c2af677
push 0xc9955f75
mov dword [ebp - 0x1a0], eax
pushfd
pushal
push 0x92ffde92
lea esp, [esp + 0x40]
jmp fcn.00011b4f

Function at 0x24f57
Capabilities:
Hash data using murmur3

Disassembly:
bsf ax, dx
sets ah
aad 0x2c
mov esi, dword [edi + 0x14]
mov ah, ch
mov eax, dword [esi]
test sp, 0xdb1c
cmp cl, 0xc9
stc
cmp bl, ah
test al, 0x7a
pushfd
lea esp, [esp + 8]
jne 0x16883
test bh, 0x5d
pushfd
push 0x252ee106
cmp ch, 0x9e
test eax, 0x800
pushal
call fcn.00010d45
mov edi, 0x438
call fcn.0003f6ea

Function at 0x25956
Capabilities:
Hash data using murmur3

Disassembly:
dec eax
pushfd
push 0x7dd91179
lea esp, [esp + 0x14]
je 0x36cb2
call fcn.000193c2

Function at 0x259f1
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.00021304
clc
cmp eax, ebx
call fcn.000390de

Function at 0x25ab9
Capabilities:
Hash data using murmur3

Disassembly:
pushal
lea esp, [esp + 0x20]
jb 0x317ed
jmp 0x12ab0
pushal
lea esp, [esp + 0x44]
jno 0x24169
jb 0x317ed
shr si, cl
push 0x40
bsr si, si
movsx si, dl
neg si
pop esi
clc
cmc
cmp ecx, esi
pushal
lea esp, [esp + 0x20]
jae 0x3467c
movsx ax, cl
mov di, si
sub esi, ecx
pushfd
btc ax, 8
bswap ax
lea eax, [ebp + ecx*4 - 0x2cc]
rcr edi, 0x1c
mov dword [ebp - 0x1b0], esi
call fcn.0002aa04

Function at 0x25f66
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 8], 0x45
lea esp, [esp + 0x50]
jb 0x317ed
jmp 0x37292
stc
ror si, cl
push 0x40
sal si, cl
movzx si, dl
sbb esi, 0xde0548dd
pop esi
pushfd
clc
cmp ecx, esi
mov word [esp], 0x954a
jmp 0x3bd27
lea esp, [esp + 4]
jae 0x3467c
rcl ax, 8
ror al, cl
add al, bh
sar ah, cl
sub esi, ecx
bswap ax
seto al
pushfd
pushfd
lea eax, [ebp + ecx*4 - 0x2cc]
call fcn.00021c3e