joyce8/EMBER2024-capa huggingface dataset:
Function at 0x656d7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x553
lea ecx, [esi + esi]
setns dl
xchg dword [esp], edi
dec ch
jmp 0x656e04
mov cl, 0x91
mov cl, byte [esp]
bt ecx, ebx
call 0x656dde

Function at 0x844730
Capabilities:
Parse pe header

Disassembly:
push edx
push word [esp]
mov dword [esp + 4], esp
mov dword [esp], ebp
push esi
push ebp
push word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 4], edx
mov dword [esp], ebx
push bx
jmp 0x844649
push dword [esp + 4]
mov byte [esp], dh
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
jmp 0x844676

Function at 0x8506ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0085076e
jae 0x8506fb
xor ecx, ecx
call fcn.0085076e
jae 0x850725
xor eax, eax
call fcn.0085076e
jae 0x850736
mov al, 0x10
call fcn.0085076e
adc al, al
jae 0x850717
jne 0x850763
stosb byte es:[edi], al
jmp 0x8506fc
call fcn.0085077a
dec ecx
loop 0x850742
mov eax, ebp
call fcn.00850778
jmp 0x850764
lodsb al, byte [esi]
shr eax, 1
je 0x85078a
adc ecx, 2
mov ebp, eax
jmp 0x850764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00850778
cmp eax, 0x7d00
jae 0x850762
cmp eax, 0x500
jae 0x850763
cmp eax, 0x7f
ja 0x850764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8506fc
pop ebp
ret 8

Function at 0x10002290
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100120a0]
test eax, eax
je 0x10002348
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x100022d0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x100022bc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000237d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x100120a0], eax
test eax, eax
jne 0x100022ad
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x100022be
Function at 0x42733c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427412
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00408b34
lea eax, [ebp - 4]
call fcn.00408cc8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4273fc
mov eax, ebx
call fcn.00405490
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4273f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4273df
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x427424
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4273df
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4273fc
mov eax, dword [ebp - 0x10]
call fcn.004054ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427419
lea eax, [ebp - 4]
call fcn.0040870c
ret

Function at 0x427428
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x427528
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00408b34
lea eax, [ebp - 4]
call fcn.00408cc8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x427512
mov eax, ebx
call fcn.00405490
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x42750b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004097c0
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4274f5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x42753c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4274f5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427512
mov eax, dword [ebp - 0x10]
call fcn.004054ac
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42752f
lea eax, [ebp - 4]
call fcn.0040870c
ret

Function at 0x427c8c
Capabilities:
Hash data using murmur3

Disassembly:
push cs
add byte [edx - 0x18], al
mov edi, 0x81001b9f
invalid
Function at 0x427e0c
Capabilities:
Hash data using murmur3

Disassembly:
cmc
neg edx
add ecx, 0x26ff18de
xchg ecx, eax
xor dword [0x653d94], eax
call fcn.0050c385
add edi, edx
and dword [0x653cf3], esi
add edx, 0xbb97093d
add ecx, edi
rol edx, 0xc
or dword [0x653c0b], edi
sub ecx, ebp
add edx, dword [0x653f5e]
dec eax
call fcn.005e5d21
add esi, dword [0x653e91]
rol ecx, 0x1e
call fcn.0046dfee
rol edx, 0x16
xor ecx, 0x16c325a4
call fcn.00570464
inc esi
call fcn.00485472
call fcn.00514c6f
dec esi
call fcn.004b5a9f
xor ecx, 0x16c325a4
ror edx, 0x16
ror ecx, 0x1e
call fcn.004ae64c
inc eax
add ecx, ebp
add dword [0x653db6], eax
ror edx, 0xc
sub ecx, edi
xor edx, 0x61f03051
not ebx
xor ebx, 0x8aab93b4
call fcn.005d64dc
xor edx, dword [0x653ebb]
call fcn.0041f6e6
not esi
sub edi, dword [0x653f6f]
or dword [0x653cd9], ecx
mov dword [0x653d13], esi
rol edi, 4
dec ebx
or dword [0x653ccd], edx
adc eax, 0x653ccd

Function at 0x427ecc
Capabilities:
Hash data using murmur3

Disassembly:
adc eax, 0x653ccd
add ebx, dword [0x653e86]
dec esi
invalid
invalid
inc ebx
invalid

Function at 0x427edc
Capabilities:
Hash data using murmur3

Disassembly:
add byte gs:[edi - 0x6b51739], al
std
inc ecx
enter 0xffffffffffffe806, 0x3a
ror dword [edi], 1
add al, ch
ljmp 0x6c0
Function at 0x427efc
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x653d45], ebx
inc esi
xor dword [0x653da2], edi
inc ebx
ror edi, 4
xor dword [0x653cdc], esi
not esi
call fcn.0052af2e
call fcn.005ccbf8
xor ebx, 0x8aab93b4
not ebx
push edx
xor ebx, dword [0x653f57]
sub ebx, ecx
xor edx, dword [0x653e82]
xor edi, dword [0x653f94]
call fcn.0051579c
dec edx
call fcn.0056f81b
or ecx, dword [0x653ec7]
call fcn.0045180d
add edi, 0xb2de85ee
xor ebx, eax
ror edi, 0x1f
not edi
add ebx, edx
and dword [0x653ccd], 0xe1b88717
xchg esi, edx
xchg esi, edx
xor dword [0x653d48], 0xa88f1f02
sub ebx, edx
not edi
rol edi, 0x1f
xor ebx, eax
sub edi, 0xb2de85ee
call fcn.004a3cd9
call fcn.004d1560
inc edx
add ebx, ecx
mov ecx, 0xe6e4f362
sub dword [0x653db6], eax
rol edi, 0x1b
sub eax, dword [0x653ecb]
add ecx, dword [0x653e76]
call fcn.004939b4
xor ecx, 0xb201d7b8
neg ebx
sub esi, dword [0x653f30]
rol edi, 4
sub eax, dword [0x653efa]
add dword [0x653dda], ecx
call fcn.00559b63
or dword [0x653dbf], edx
ror edi, 4
neg ebx
xor ecx, 0xb201d7b8
call fcn.005e36e0
ror edi, 0x1b
xor dword [0x653d57], esi
sub ecx, 0xf5e4616e
add edx, 0x5366a7b5
xor ebx, esi
neg ecx
call fcn.0040380f
xor esi, ebx
xor ecx, dword [0x653f79]
rol edi, 1
call fcn.00588b50
or edx, dword [0x653f24]
xchg ebx, esi
dec edi
xor ebx, dword [0x653eb5]
sub edx, 0xd00968fd
add edx, 0xd00968fd
inc edi
xchg ebx, esi
call fcn.0054f78c
ror edi, 1
xor esi, ebx
call fcn.0059d3f5
neg ecx
xor ebx, esi
sub edx, 0x5366a7b5
sub ecx, 0x828e2c89
add eax, esp
call fcn.0043a6b1
sub eax, esi
xor ecx, 0x88bbc83
xchg edi, esi
or esi, dword [0x653ee6]
not esi
xor dword [0x653c64], ecx
not esi
xor esi, ebx
call fcn.005ddf32
inc ebx
sub dword [0x653da5], edi
sub edi, dword [0x653ed3]
mov dword [0x653c4c], esi
xor dword [0x653d25], edi
xor ecx, dword [0x653ec9]
add edi, edx
sub ecx, 0xa8bf8c9a
xor edi, dword [0x653e5c]
add ecx, 0xa8bf8c9a
sub edi, edx
and dword [0x653d77], ebx
add dword [0x653d5b], esi
mov dword [0x653ce9], esi
dec ebx
call fcn.004c81eb
xor esi, ebx
not esi
and dword [0x653c24], edx
not esi
xchg edi, esi
xor ecx, 0x88bbc83
add eax, esi
call fcn.0059b01e
sub eax, esp
push ecx
inc eax
not edx
sub ecx, dword [0x653f4d]
ror edx, 0xd
or dword [0x653c9a], ecx
add dword [0x653c43], esi
add eax, dword [0x653eec]
ror edx, 0xa
call fcn.00427828
or dword [0x653d6e], edx
call fcn.004a4061
dec ecx
call fcn.0047208b
add ecx, 0xd2dee2fd
xor esi, 0xb275bcc7
sub eax, ebx
add ecx, esi
xor edi, 0xe907b9b8
not esi
call fcn.005c0c17
call fcn.00570464
invalid

Function at 0x428144
Capabilities:
Hash data using murmur3

Disassembly:
salc
mov ecx, dword [0x653274]
mov dl, 1
mov eax, dword [0x41d94c]
call fcn.00426680
call fcn.00407e08
mov eax, dword [ebp + 0x10]
add eax, esi
push eax
mov eax, dword [ebp - 0x10]
sub eax, esi
push eax
mov eax, dword [ebp - 8]
call fcn.004097c0
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, eax
add edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x428478
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x653d37], eax
inc eax
add edx, edi
dec esi
rol edi, 0xd
not esi
xor esi, 0x5e5063b
rol eax, 0x1b
xchg edi, eax
and dword [0x653d99], eax
add edi, dword [0x653fb9]
xor edi, 0x4e052c1f
neg esi
add dword [0x653c87], edi
xchg esi, eax
call fcn.004fa983
xchg esi, eax
sub dword [0x653d51], esi
neg esi
xor edi, 0x4e052c1f
add dword [0x653d6b], eax
xchg edi, eax
ror eax, 0x1b
xor esi, 0x5e5063b
not esi
ror edi, 0xd
inc esi
sub edx, edi
dec eax
xor dword [0x653d68], eax
xor dword [0x653c61], esi
sub edi, ebp
call fcn.0055769c
neg edx
xor ecx, 0x3d0c3175
xor edx, dword [0x653e4b]
rol ecx, 0x15
sub edx, dword [0x653eb3]
add ebx, 0xc851e6b2
neg edx
sub esi, dword [0x653ea4]
inc esi
sub edx, dword [0x653f0b]
or edi, dword [edi]
add cl, al
enter 0x30c, 0xffffffffffffffd8
call fcn.005c345b
add eax, ecx
call fcn.0043fb84
call fcn.0058f05f
call fcn.00605ba4
call fcn.004d1aa9
sub eax, ecx
call fcn.004dc99e
sub ebx, eax
rol eax, 0xc
dec esi
neg edx
sub ebx, 0xc851e6b2
ror ecx, 0x15
xor ecx, 0xa973e1cb
neg ecx
or dword [0x653c1a], ebx
sub esi, dword [0x653f1c]
rol eax, 0x19
sub esi, dword [0x653e68]
xor dword [0x653d3d], ebx
cmp eax, 0xe9810065
int 0xae
or eax, 0x1fcbc1a2
neg eax
xor ebx, 0x787d1b50
inc ebx
neg esi
ror ecx, 3
and dword [0x653cf4], ebx
or dword [0x653c5f], esi
rol ecx, 3
neg esi
dec ebx
xor ebx, 0x787d1b50
neg eax
rol ebx, 0x1f
add ecx, 0xa20daecd
mov dword [0x653d1d], edx
ror eax, 0x19
xor dword [0x653c42], ecx
neg ecx
push ecx
xchg esi, eax
not esi
sub edx, ebx
xchg edi, eax
ror ecx, 0x1a
xchg edx, esi
add dword [0x653d34], esi
call fcn.00485472
sub dword [0x653c6a], ecx
call fcn.004d8f3e
sub dword [0x653cf6], 0x6aaa5e50
xor ecx, 0xad7ded5e
neg edx
rol eax, 0xe
call fcn.004d6c43
and dword [0x653ccf], edx
call fcn.004a3419
call fcn.0047c244
Function at 0x428518
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x653d37], eax
inc eax
add edx, edi
dec esi
rol edi, 0xd
not esi
xor esi, 0x5e5063b
rol eax, 0x1b
xchg edi, eax
and dword [0x653d99], eax
add edi, dword [0x653fb9]
xor edi, 0x4e052c1f
neg esi
add dword [0x653c87], edi
xchg esi, eax
call fcn.004fa983
xchg esi, eax
sub dword [0x653d51], esi
neg esi
xor edi, 0x4e052c1f
add dword [0x653d6b], eax
xchg edi, eax
ror eax, 0x1b
xor esi, 0x5e5063b
not esi
ror edi, 0xd
inc esi
sub edx, edi
dec eax
xor dword [0x653d68], eax
xor dword [0x653c61], esi
sub edi, ebp
call fcn.0055769c
neg edx
xor ecx, 0x3d0c3175
xor edx, dword [0x653e4b]
rol ecx, 0x15
sub edx, dword [0x653eb3]
add ebx, 0xc851e6b2
neg edx
sub esi, dword [0x653ea4]
inc esi
sub edx, dword [0x653f0b]
or edi, dword [edi]
add cl, al
enter 0x30c, 0xffffffffffffffd8
call fcn.005c345b
add eax, ecx
call fcn.0043fb84
call fcn.0058f05f
call fcn.00605ba4
call fcn.004d1aa9
sub eax, ecx
call fcn.004dc99e
sub ebx, eax
rol eax, 0xc
dec esi
neg edx
sub ebx, 0xc851e6b2
ror ecx, 0x15
xor ecx, 0xa973e1cb
neg ecx
or dword [0x653c1a], ebx
sub esi, dword [0x653f1c]
rol eax, 0x19
sub esi, dword [0x653e68]
xor dword [0x653d3d], ebx
cmp eax, 0xe9810065
int 0xae
or eax, 0x1fcbc1a2
neg eax
xor ebx, 0x787d1b50
inc ebx
neg esi
ror ecx, 3
and dword [0x653cf4], ebx
or dword [0x653c5f], esi
rol ecx, 3
neg esi
dec ebx
xor ebx, 0x787d1b50
neg eax
rol ebx, 0x1f
add ecx, 0xa20daecd
mov dword [0x653d1d], edx
ror eax, 0x19
xor dword [0x653c42], ecx
neg ecx
push ecx
xchg esi, eax
not esi
sub edx, ebx
xchg edi, eax
ror ecx, 0x1a
xchg edx, esi
add dword [0x653d34], esi
call fcn.00485472
sub dword [0x653c6a], ecx
call fcn.004d8f3e
sub dword [0x653cf6], 0x6aaa5e50
xor ecx, 0xad7ded5e
neg edx
rol eax, 0xe
call fcn.004d6c43
and dword [0x653ccf], edx
call fcn.004a3419
call fcn.0047c244
Function at 0x428574
Capabilities:
Hash data using murmur3

Disassembly:
and dword [0x653d37], eax
inc eax
add edx, edi
dec esi
rol edi, 0xd
not esi
xor esi, 0x5e5063b
rol eax, 0x1b
xchg edi, eax
and dword [0x653d99], eax
add edi, dword [0x653fb9]
xor edi, 0x4e052c1f
neg esi
add dword [0x653c87], edi
xchg esi, eax
call fcn.004fa983
xchg esi, eax
sub dword [0x653d51], esi
neg esi
xor edi, 0x4e052c1f
add dword [0x653d6b], eax
xchg edi, eax
ror eax, 0x1b
xor esi, 0x5e5063b
not esi
ror edi, 0xd
inc esi
sub edx, edi
dec eax
xor dword [0x653d68], eax
xor dword [0x653c61], esi
sub edi, ebp
call fcn.0055769c
neg edx
xor ecx, 0x3d0c3175
xor edx, dword [0x653e4b]
rol ecx, 0x15
sub edx, dword [0x653eb3]
add ebx, 0xc851e6b2
neg edx
sub esi, dword [0x653ea4]
inc esi
sub edx, dword [0x653f0b]
or edi, dword [edi]
add cl, al
enter 0x30c, 0xffffffffffffffd8
call fcn.005c345b
add eax, ecx
call fcn.0043fb84
call fcn.0058f05f
call fcn.00605ba4
call fcn.004d1aa9
sub eax, ecx
call fcn.004dc99e
sub ebx, eax
rol eax, 0xc
dec esi
neg edx
sub ebx, 0xc851e6b2
ror ecx, 0x15
xor ecx, 0xa973e1cb
neg ecx
or dword [0x653c1a], ebx
sub esi, dword [0x653f1c]
rol eax, 0x19
sub esi, dword [0x653e68]
xor dword [0x653d3d], ebx
cmp eax, 0xe9810065
int 0xae
or eax, 0x1fcbc1a2
neg eax
xor ebx, 0x787d1b50
inc ebx
neg esi
ror ecx, 3
and dword [0x653cf4], ebx
or dword [0x653c5f], esi
rol ecx, 3
neg esi
dec ebx
xor ebx, 0x787d1b50
neg eax
rol ebx, 0x1f
add ecx, 0xa20daecd
mov dword [0x653d1d], edx
ror eax, 0x19
xor dword [0x653c42], ecx
neg ecx
push ecx
xchg esi, eax
not esi
sub edx, ebx
xchg edi, eax
ror ecx, 0x1a
xchg edx, esi
add dword [0x653d34], esi
call fcn.00485472
sub dword [0x653c6a], ecx
call fcn.004d8f3e
sub dword [0x653cf6], 0x6aaa5e50
xor ecx, 0xad7ded5e
neg edx
rol eax, 0xe
call fcn.004d6c43
and dword [0x653ccf], edx
call fcn.004a3419
call fcn.0047c244

Function at 0x428610
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.004b1c61
ror eax, 0xe
neg edx
xor ecx, 0xad7ded5e
mov dword [0x653d79], 0x46177064
call fcn.0043a6b1
mov dword [0x653d10], ecx
xchg edx, esi
rol ecx, 0x1a
xchg edi, eax
add edx, ebx
not esi
xchg esi, eax
mov edx, 0x61d379de
add edi, 0x91804d4e
ror edx, 0xd
sub ecx, 0xbaea7473
rol edi, 0x11
inc eax
xor ebx, 0x4132b12d
invalid
invalid
invalid
invalid

Function at 0x42869c
Capabilities:
Hash data using murmur3

Disassembly:
cmp al, 0x65
add bh, dh
rol cl, cl
enter 0xffffffffffff8106, 0xfffffffffffffff0
test dword [edi - 0x107e45f7], 0xfb850c89

Function at 0x428788
Capabilities:
Hash data using murmur3

Disassembly:
or eax, 0x18f3814f
and eax, 0xb1e875f1
xor byte [ecx], dl
add cl, al
iretd
Function at 0x42888c
Capabilities:
Hash data using murmur3

Disassembly:
xchg ebx, eax
inc edx
not ecx
add ecx, 0x333af4f5
call fcn.004af058
add edi, 0x1f9195f6
add edi, 0x736c4852
neg edx
call fcn.005273f5
neg edi
xor edi, 0xe3658507
add edx, 0x4729ece1
call fcn.00407664
sub ebx, dword [0x653e75]
add ecx, dword [0x653efb]
xor esi, dword [0x653f44]
call fcn.004c452c
call fcn.0045ad76
call fcn.0045180d
sub edx, 0x4729ece1
xor edi, 0xe3658507
neg edi
call fcn.0055ff8d
neg edx
push edi
inc edi
ror eax, 0xe
sub esi, dword [0x653ee5]
xchg ecx, eax
xor esi, 0xa7897777
not edx
xor ebx, 0x9a0cdc1a
xor dword [0x653dc8], ecx
or ecx, dword [0x653e8c]
xor dword [0x653c05], ebx
sub dword [0x653c94], edi
xor ebx, 0x9a0cdc1a
not edx
xor esi, 0xa7897777
xchg ecx, eax
rol eax, 0xe
dec edi
push esp
sub dword [0x653c9f], edi
xor dword [0x653d82], edi
xor edi, 0x366f253b
xchg ebx, edx
sub edi, dword [0x653f9c]
sub edx, dword [0x653f9c]
add dword [0x653c00], 0xe2333419
xor esp, edx
xor ebx, dword [0x653f26]
xor eax, 0x49a62b07
sub esi, dword [0x653e57]
call fcn.0058eb3d
or dword [0x653d4a], esi
xchg eax, esi
neg esi
sub edi, edx
rol ebx, 5
call fcn.005c306f
ror ebx, 5
add edi, edx
neg esi
xchg eax, esi
call fcn.0048905b
xor eax, 0x49a62b07
xchg ebx, edx
xor edi, 0x366f253b
mov dword [0x653d40], esi
push eax
sub edi, ebx
xor ebx, edi
rol ebx, 0x12
add ecx, 0x83c4f47d
sub dword [0x653d2b], edi
sub dword [0x653cb9], esi
and dword [0x653c1d], ecx
xor edx, dword [0x653e12]
xor ebx, dword [0x653fa2]
xor eax, dword [0x653ea1]
add esi, ecx
xor edi, 0xc6f7dcd1
add ecx, esp
ror edi, 7
inc ebx
and dword [0x653dc6], eax
ror edx, 0xe
neg ebx
sub dword [0x653cce], esi
rol eax, 0x18
call fcn.0054b55e
call fcn.005e470d
ror eax, 0x18
neg ebx
rol edx, 0xe
mov dword [0x653c93], ecx
dec ebx
rol edi, 7
sub ecx, esp
xor edi, 0xc6f7dcd1
sub esi, ecx
add dword [0x653dc2], edi
sub ecx, 0x83c4f47d
ror ebx, 0x12
xor ebx, edi
add edi, ebx
call dword [sym.imp.kernel32.dll_GetProcAddress]
neg esi
add edi, dword [0x653e19]
xchg eax, esi
rol eax, 0x11
xor ebx, dword [0x653f1f]
call fcn.006038e8
add eax, dword [0x653ea4]
ror ebx, 0xe
mov dword [0x653c58], edi
call fcn.004d74fa
mov dword [0x653d1d], esi
xor esi, esp
add eax, 0xcb80e7ae
ror ecx, 0x11
add esi, 0xb511b023
call fcn.0054853c
call fcn.0056f81b
sub esi, 0xb511b023
rol ecx, 0x11
sub eax, 0xcb80e7ae
xor esi, esp
xor dword [0x653c17], edi
call fcn.0056f81b
xor dword [0x653dc2], eax
rol ebx, 0xe
ror eax, 0x11
xchg eax, esi
neg esi
add esp, 0x10
sub edi, 0x6b41bc47
xor esi, dword [0x653ed4]
or eax, dword [0x653e15]
mov dword [0x653d6e], eax
call fcn.004ab1a7
add eax, 0x34a03a54
sub ebx, 0x11f32aed
xor dword [0x653c36], edx
rol esi, 5
add esi, 0x78201ce1
or dword [0x653d3f], edi
rol esi, 0x11
xchg ecx, esi
int1
call fcn.004fab9e
call fcn.0042768d
xchg ecx, esi
ror esi, 0x11
and dword [0x653c86], ecx
sub esi, 0x78201ce1
Function at 0x428b24
Capabilities:
Hash data using murmur3

Disassembly:
ror esi, 5
sub dword [0x653d9d], esi
add ebx, 0x11f32aed
sub eax, 0x34a03a54
mov dword [0x653da7], edi
add edi, 0x6b41bc47
mov ebx, 0xe24c67fb
or dword [0x653cd8], ecx
xchg eax, esi
xor esi, ebp
add edx, dword [0x653e20]
call fcn.0059c576
neg esi
fiadd word [ebx]
xor eax, 0x653ea1

Function at 0x428b60
Capabilities:
Hash data using murmur3

Disassembly:
fiadd word [ebx]
xor eax, 0x653ea1
and dword [0x653c19], eax
ror ecx, 9
sub eax, 0xda53dae8
call fcn.00461569
sub dword [0x653cd4], esi
add dword [0x653d72], edx
add eax, 0xda53dae8
rol ecx, 9

Function at 0x428b90
Capabilities:
Hash data using murmur3

Disassembly:
add dword [0x653d46], ebx
neg esi
call fcn.00479c08
xor esi, ebp
xchg eax, esi
add ebx, 0x1f506b0d
call fcn.004bf5ab
add esi, ebp
call fcn.00485472
enter 5, 0x21
adc eax, 0x653ca9
sub edx, 0x83b138ed
not esi
call fcn.004d2e98
add esi, 0x1ee5b9e4
mov dword [0x653dc1], esi
sub ebx, edx
xor eax, edx
rol edi, 0x11
neg ebx
call fcn.00504bc5
call fcn.0054062b
neg ebx
ror edi, 0x11
xor eax, edx
add ebx, edx
add dword [0x653cec], ebx
sub esi, 0x1ee5b9e4
call fcn.005a3151
not esi
add edx, 0x83b138ed
sub esi, ebp
call fcn.005fa7fa
add ebx, 0xfe632d38
inc eax
sub eax, dword [0x653f3d]
inc ecx
inc eax
rol ecx, 1
xor edx, esi
and dword [0x653c74], edx
xor edi, dword [0x653f5e]
xchg esi, eax
call fcn.00420c16
mov dword [0x653c34], ecx
sub dword [0x653cd2], ebx
call fcn.0050c385
xchg esi, eax
xor edx, esi
ror ecx, 1
dec eax
dec ecx
dec eax
push ebx
xor edi, 0x298347dd
add ebx, edi
xchg edx, esi
neg ebx
xor esi, ebx
sub ecx, ebp
mov dword [0x653ce7], edx
xchg ecx, eax
call fcn.005a9afd
neg edx
xor eax, dword [0x653f4d]
sub dword [0x653d7b], 0xbc5de178
js 0x428c5f
pop ebp
mov esp, 0x2113c7c1
sbb eax, 0x653d82
xor ecx, 0xf7ad772f
neg ecx
dec esi
or edx, dword [0x653e1d]
inc edx
inc ecx
add dword [0x653ca5], ebx
xor dword [0x653c6d], esi
dec ecx
dec edx
inc esi
neg ecx
xor ecx, 0xf7ad772f
add dword [0x653d28], esi
ror edi, 0x13
add dword [0x653d70], 0xc25d0d9c
neg edx
xchg ecx, eax
add ecx, ebp
xor esi, ebx
neg ebx
xchg edx, esi
sub ebx, edi
xor edi, 0x298347dd
mov edx, 0x6e798666
add esi, 0x4069ab2c
or esi, dword [0x653f4f]
xor esi, 0xba15ac8e
neg esi
sub eax, edi
add dword [0x653d6e], eax
sub edx, 0x94672e61
ror edi, 0x1a
sub ebx, 0x610d20c5

Function at 0x428bb0
Capabilities:
Hash data using murmur3

Disassembly:
enter 5, 0x21
adc eax, 0x653ca9

Function at 0x428c7c
Capabilities:
Hash data using murmur3

Disassembly:
js 0x428c5f
pop ebp
mov esp, 0x2113c7c1
sbb eax, 0x653d82