joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da950
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 4], ebx
je 0x4da970
cmp dword [edi + 0xc], ebx
je 0x4da9de
cmp dword [edi + 0x10], ebx
je 0x4da9de
cmp dword [edi + 0x14], ebx
je 0x4da9de
pop edi
lea eax, [ebx + 1]
pop ebx
ret
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 4], eax
test eax, eax
je 0x4da9de
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.BeginBufferedPaint
push eax
call esi
push str.BufferedPaintSetAlpha
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.EndBufferedPaint
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.BufferedPaintUnInit
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.BufferedPaintInit
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
mov dword [edi + 0x1c], eax
pop esi
cmp dword [edi + 0xc], ebx
je 0x4da9de
cmp dword [edi + 0x10], ebx
je 0x4da9de
cmp dword [edi + 0x14], ebx
mov eax, 1
cmovne ebx, eax
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x4db1f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
push 0x2c
lea eax, [esp + 8]
mov dword [esp + 4], 0x30
push 0
push eax
call fcn.005111c0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x14], eax
call fcn.004db990
test eax, eax
mov dword [esp + 8], 0x4dae70
mov ecx, 0x5c0020
cmove ecx, dword [esp + 0x28]
push 0
mov dword [esp + 0x2c], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x18]
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push 0x589c34
push dword [esp + 0x50]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x5c0014], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5d0440]
mov eax, 0x2aaaaaab
sub ecx, dword [0x5d043c]
imul ecx
mov dword [0x5ba350], 0
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4db2c9
push 0
push 0x32
push 1
push dword [0x5c0014]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x5ba350], 1
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4df4c0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x100]
mov dword [esi], vtable.CAnimateMgr.1.0
push edi
mov dword [esi + 0x34], vtable.CAnimateMgr.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xf0]
push edi
mov dword [esi + 0xf4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x3e8
push dword [esi + 0xfc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4df521
push 0
push dword [esi + 0xfc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0xfc], 0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [esi + 0xf0]
test ecx, ecx
je 0x4df562
mov eax, dword [esi + 0xf8]
sub eax, ecx
sar eax, 2
push eax
push ecx
call fcn.004dff50
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
pop edi
mov ecx, esi
pop esi
jmp fcn.00458f40

Function at 0x4df5d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
jne 0x4df5e9
pop edi
mov eax, 0x80004005
pop esi
pop ebp
ret 4
push ebx
lea ebx, [edi + 0x100]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xf4]
lea ecx, [edi + 0xf0]
mov edx, dword [ecx]
cmp edx, eax
je 0x4df61f
nop dword [eax]
cmp dword [edx], esi
je 0x4df61b
add edx, 4
cmp edx, eax
jne 0x4df610
cmp edx, eax
jne 0x4df62b
lea eax, [ebp + 8]
push eax
call fcn.004df980
mov esi, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi]
pop ebx
cmp eax, vtable.CXAnimation.0
jne 0x4df667
cmp dword [edi + 0xfc], 0
jne 0x4df65f
push 0
push 0
push edi
push 0x4df570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xfc], eax
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
mov ecx, esi
call dword [eax + 4]
jmp 0x4df63c
Function at 0x4e6080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4e60a4
cmp dword [esi + 4], 0
je 0x4e609d
push eax
call fcn.0052b86e
add esp, 4
mov dword [esi + 0x10], 0
push 0x581704
push dword [ebp + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
call fcn.005393c2
mov edi, eax
add esp, 8
test edi, edi
jne 0x4e60ce
pop edi
pop esi
pop ebp
ret 4
push ebx
push 2
push 0
push edi
call fcn.00539827
push edi
call fcn.00539e5d
push 0
push 0
push edi
mov ebx, eax
call fcn.00539827
add esp, 0x1c
test ebx, ebx
jle 0x4e610e
push ebx
mov ecx, esi
call fcn.004e6190
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4e610e
push edi
push 1
push ebx
push eax
call fcn.0053a078
add esp, 0x10
push edi
call fcn.0053a21f
add esp, 4
xor eax, eax
cmp dword [esi + 0x10], eax
setne al
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4e67c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56e896
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5a7074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx]
push dword [eax + 4]
call fcn.004e71b0
mov eax, dword [ebx]
mov dword [eax + 4], eax
mov eax, dword [ebx]
mov dword [eax], eax
mov eax, dword [ebx]
mov dword [ebp - 4], 0xffffffff
mov dword [eax + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 4], 0
test eax, eax
je 0x4e6880
push 0x581704
push eax
call fcn.005393c2
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
test edi, edi
je 0x4e6880
push edi
call fcn.0053d267
add esp, 4
push eax
call fcn.0053d251
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push edi
push 1
push 8
push eax
call fcn.0053a078
add esp, 0x10
mov byte [ebp + 0xb], 0
cmp dword [ebp - 0x24], 0x78646972
jne 0x4e690f
cmp dword [ebp - 0x20], 0x8000
jb 0x4e6896
push edi
call fcn.0053a21f
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add esi, 0xfffffff8
push esi
call fcn.0052b94b
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x4e690f
push edi
push 1
push esi
push ebx
call fcn.0053a078
lea edx, [ebx + esi]
mov ecx, ebx
xor ebx, ebx
mov dword [ebp + 8], edx
add esp, 0x10
cmp dword [ebp - 0x20], ebx
jle 0x4e68fd
mov edi, dword [ebp - 0x14]
nop word [eax + eax]
mov esi, dword [ecx + 0xc]
add esi, 0x12
add esi, ecx
cmp esi, edx
ja 0x4e68fa
push dword [ecx + 8]
lea eax, [ecx + 0x10]
push dword [ecx + 4]
push dword [ecx]
mov ecx, edi
push eax
call fcn.004e6410
mov edx, dword [ebp + 8]
inc ebx
mov ecx, esi
cmp ebx, dword [ebp - 0x20]
jl 0x4e68d0
mov edi, dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0052b86e
add esp, 4
cmp ebx, dword [ebp - 0x20]
sete byte [ebp + 0xb]
push edi
call fcn.0053a21f
mov al, byte [ebp + 0xb]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e8340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4e83e4
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4e83e4
mov eax, dword [edi]
mov eax, dword [eax + 0xa4]
cmp eax, method.CXFloatWnd.virtual_164
jne 0x4e83eb
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x5d0478]
add esi, 0x10
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5d033c]
lea eax, [ebp - 4]
push eax
call fcn.00429420
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x4e83b7
pop esi
pop ebx
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x128]
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
lea eax, [ebp - 4]
push eax
call fcn.00429350
test eax, eax
je 0x4e83db
push 0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, edi
call eax
jmp 0x4e8374

Function at 0x4e8400
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov eax, dword [eax + 0xa4]
cmp eax, method.CXFloatWnd.virtual_164
jne 0x4e8486
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x5d0478]
add esi, 0x10
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x5d033c]
lea eax, [ebp - 4]
push eax
call fcn.00429420
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x4e8459
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x128]
mov dword [ebp - 4], eax
lea ecx, [ebx + 4]
lea eax, [ebp - 4]
push eax
call fcn.00429350
test eax, eax
je 0x4e847d
push 0
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call eax
jmp 0x4e8418
Function at 0x4eb380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ec33
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5a7074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5d02fc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x5d02fc
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x5848dd
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.004e8d80
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4eb830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
jne 0x4eb88a
cmp byte [esi + 0x2c], bl
jne 0x4eb881
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4eb860
sub ecx, edi
push ecx
push edx
lea ecx, [esi + 0x34]
call fcn.004e8d80
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov edi, dword [esi + 0x18]
test edi, edi
je 0x4eb8a0
mov ecx, edi
mov edi, dword [edi + 0x28]
push 1
mov eax, dword [ecx]
call dword [eax]
test edi, edi
jne 0x4eb891
push 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.00539827
push ebx
call fcn.00539e5d
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.00539827
add esp, 0x1c
test edi, edi
jg 0x4eb90c
cmp byte [esi + 0x2c], 0
jne 0x4eb881
mov edx, dword [str.Error_document_empty.]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 0xc
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4eb900
jmp 0x4eb867
lea eax, [edi + 1]
push eax
call fcn.0050a756
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.0053a078
add esp, 0x14
cmp eax, 1
je 0x4eb964
push edi
call fcn.0050a0d1
add esp, 4
cmp byte [esi + 0x2c], 0
jne 0x4eb881
mov edx, dword [str.Failed_to_open_file]
mov ecx, edx
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 2
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4eb958
jmp 0x4eb867
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x4eb98f
mov dl, byte [eax]
mov ebx, eax
cmp dl, 0xd
jne 0x4eb986
inc eax
mov byte [ecx], 0xa
cmp byte [eax], 0xa
cmovne eax, ebx
jmp 0x4eb988
mov byte [ecx], dl
inc eax
inc ecx
cmp byte [eax], 0
jne 0x4eb971
push dword [ebp + 0xc]
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push edi
call dword [eax + 8]
push edi
call fcn.0050a0d1
add esp, 4
cmp byte [esi + 0x2c], 0
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x52bf70
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.0044b79b
not esi
xor edx, 0x6cd4ede3
inc eax
ror ecx, 0x13
sub ecx, ebx
or edx, dword [0x5d0d85]
call fcn.0048a492
ror edi, 0x15
call fcn.004e5a38
lcall 0x1503, 0xd1f7fffb
pop ebx
minps xmm0, xmmword [eax]
and dword [0x5d09c7], ecx
rol ebx, 6
sub edx, 0xe6e17c0
or eax, dword [0x5d0e20]
call fcn.004b6315
clc
inc dword [ecx + 0x6e17c0c2]
push cs
ror ebx, 6
xor dword [0x5d0a6e], edi
not ecx
call fcn.0044f102
rol edi, 0x15
call fcn.0046a412
add ecx, ebx
rol ecx, 0x13
dec eax
xor edx, 0x6cd4ede3
not esi
call fcn.004523c4
ror ebx, 0xf
xchg ecx, esi
and dword [0x5d0b39], edx
push esp
xor eax, 0x7ffaaf93
inc edi
xor ebx, dword [0x5d0e52]
neg esi
invalid

Function at 0x52bf93
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
lcall 0x1503, 0xd1f7fffb
pop ebx
minps xmm0, xmmword [eax]
Function at 0x52bfb6
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.0044b79b
not esi
xor edx, 0x6cd4ede3
inc eax
ror ecx, 0x13
sub ecx, ebx
or edx, dword [0x5d0d85]
call fcn.0048a492
ror edi, 0x15
call fcn.004e5a38
lcall 0x1503, 0xd1f7fffb
pop ebx
minps xmm0, xmmword [eax]
and dword [0x5d09c7], ecx
rol ebx, 6
sub edx, 0xe6e17c0
or eax, dword [0x5d0e20]
call fcn.004b6315
clc
inc dword [ecx + 0x6e17c0c2]
push cs
ror ebx, 6
xor dword [0x5d0a6e], edi
not ecx
call fcn.0044f102
rol edi, 0x15
call fcn.0046a412
add ecx, ebx
rol ecx, 0x13
dec eax
xor edx, 0x6cd4ede3
not esi
call fcn.004523c4
ror ebx, 0xf
xchg ecx, esi
and dword [0x5d0b39], edx
push esp
xor eax, 0x7ffaaf93
inc edi
xor ebx, dword [0x5d0e52]
neg esi
invalid

Function at 0x52c073
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cli
jg 0x52c075
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
sub edx, dword [0x5d0df3]
rol edx, 0xd
or edi, dword [0x5d0d24]
add esi, eax
xor edx, edi
not edx
or ecx, dword [0x5d0f80]
or eax, 0x5d0f80
ror edi, 0x17
call fcn.00441d25
and dword [0x5d0bb8], edi
neg eax
call fcn.004e0826
neg eax
sub dword [0x5d08f9], edx
stc
or byte [ebp], bl
call fcn.00472292
rol edi, 0x17
not edx
xor edx, edi
sub esi, eax
ror edx, 0xd
add esp, 0xc
inc eax
sub edx, ecx
xchg esi, edx
call fcn.00464eb2
loope 0x52c05c
inc ecx
into
add eax, 0x9c20d21
pop ebp
add al, ch
or dword [edi - 0x3eb10003], 0xffffffc3
adc byte [ecx + 0x7d3ecef2], al
add dword [ebx], eax
xor eax, 0x5d0eb3
mov bl, 0xe
pop ebp
invalid
xchg ecx, edx
call fcn.0040ded6
xchg ecx, edx
xor edx, 0x17d3ece
ror ebx, 0x10
inc esi
call fcn.0047e3c8
mov dword [0x5d0996], esi
rol esi, 5
xchg esi, edx
add edx, ecx
dec eax
mov edx, 0xeb956be
rol eax, 0xa
and dword [0x5d0a9f], 0xf39a85d2
dec edx
rol ecx, 0xe
dec ecx
call fcn.004e8fa9
ror ebx, 9
add eax, edx
mov dword [0x5d0c09], 0x13b35af
xor ebx, 0xe8b6d9ef
or ecx, dword [0x5d0d4d]
rol esi, 2
xor edx, dword [0x5d0e38]
xchg ecx, eax
xor dword [0x5d0bf8], 0x1045f575
call fcn.004dea32
Function at 0x52c091
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cli
jg 0x52c075
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
sub edx, dword [0x5d0df3]
rol edx, 0xd
or edi, dword [0x5d0d24]
add esi, eax
xor edx, edi
not edx
or ecx, dword [0x5d0f80]
or eax, 0x5d0f80
ror edi, 0x17
call fcn.00441d25
and dword [0x5d0bb8], edi
neg eax
call fcn.004e0826
neg eax
sub dword [0x5d08f9], edx
stc
or byte [ebp], bl
call fcn.00472292
rol edi, 0x17
not edx
xor edx, edi
sub esi, eax
ror edx, 0xd
add esp, 0xc
inc eax
sub edx, ecx
xchg esi, edx
call fcn.00464eb2
loope 0x52c05c
inc ecx
into
add eax, 0x9c20d21
pop ebp
add al, ch
or dword [edi - 0x3eb10003], 0xffffffc3
adc byte [ecx + 0x7d3ecef2], al
add dword [ebx], eax
xor eax, 0x5d0eb3
mov bl, 0xe
pop ebp
invalid
xchg ecx, edx
call fcn.0040ded6
xchg ecx, edx
xor edx, 0x17d3ece
ror ebx, 0x10
inc esi
call fcn.0047e3c8
mov dword [0x5d0996], esi
rol esi, 5
xchg esi, edx
add edx, ecx
dec eax
mov edx, 0xeb956be
rol eax, 0xa
and dword [0x5d0a9f], 0xf39a85d2
dec edx
rol ecx, 0xe
dec ecx
call fcn.004e8fa9
ror ebx, 9
add eax, edx
mov dword [0x5d0c09], 0x13b35af
xor ebx, 0xe8b6d9ef
or ecx, dword [0x5d0d4d]
rol esi, 2
xor edx, dword [0x5d0e38]
xchg ecx, eax
xor dword [0x5d0bf8], 0x1045f575
call fcn.004dea32

Function at 0x52c0af
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cli
jg 0x52c075
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
sub edx, dword [0x5d0df3]
rol edx, 0xd
or edi, dword [0x5d0d24]
add esi, eax
xor edx, edi
not edx
or ecx, dword [0x5d0f80]
or eax, 0x5d0f80
ror edi, 0x17
call fcn.00441d25
and dword [0x5d0bb8], edi
neg eax
call fcn.004e0826
neg eax
sub dword [0x5d08f9], edx
stc
or byte [ebp], bl
call fcn.00472292
rol edi, 0x17
not edx
xor edx, edi
sub esi, eax
ror edx, 0xd
add esp, 0xc
inc eax
sub edx, ecx
xchg esi, edx
call fcn.00464eb2
loope 0x52c05c
inc ecx
into
add eax, 0x9c20d21
pop ebp
add al, ch
or dword [edi - 0x3eb10003], 0xffffffc3
adc byte [ecx + 0x7d3ecef2], al
add dword [ebx], eax
xor eax, 0x5d0eb3
mov bl, 0xe
pop ebp
invalid
xchg ecx, edx
call fcn.0040ded6
xchg ecx, edx
xor edx, 0x17d3ece
ror ebx, 0x10
inc esi
call fcn.0047e3c8
mov dword [0x5d0996], esi
rol esi, 5
xchg esi, edx
add edx, ecx
dec eax
mov edx, 0xeb956be
rol eax, 0xa
and dword [0x5d0a9f], 0xf39a85d2
dec edx
rol ecx, 0xe
dec ecx
call fcn.004e8fa9
ror ebx, 9
add eax, edx
mov dword [0x5d0c09], 0x13b35af
xor ebx, 0xe8b6d9ef
or ecx, dword [0x5d0d4d]
rol esi, 2
xor edx, dword [0x5d0e38]
xchg ecx, eax
xor dword [0x5d0bf8], 0x1045f575
call fcn.004dea32
Function at 0x52c0cd
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cli
jg 0x52c075
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
sub edx, dword [0x5d0df3]
rol edx, 0xd
or edi, dword [0x5d0d24]
add esi, eax
xor edx, edi
not edx
or ecx, dword [0x5d0f80]
or eax, 0x5d0f80
ror edi, 0x17
call fcn.00441d25
and dword [0x5d0bb8], edi
neg eax
call fcn.004e0826
neg eax
sub dword [0x5d08f9], edx
stc
or byte [ebp], bl
call fcn.00472292
rol edi, 0x17
not edx
xor edx, edi
sub esi, eax
ror edx, 0xd
add esp, 0xc
inc eax
sub edx, ecx
xchg esi, edx
call fcn.00464eb2
loope 0x52c05c
inc ecx
into
add eax, 0x9c20d21
pop ebp
add al, ch
or dword [edi - 0x3eb10003], 0xffffffc3
adc byte [ecx + 0x7d3ecef2], al
add dword [ebx], eax
xor eax, 0x5d0eb3
mov bl, 0xe
pop ebp
invalid
xchg ecx, edx
call fcn.0040ded6
xchg ecx, edx
xor edx, 0x17d3ece
ror ebx, 0x10
inc esi
call fcn.0047e3c8
mov dword [0x5d0996], esi
rol esi, 5
xchg esi, edx
add edx, ecx
dec eax
mov edx, 0xeb956be
rol eax, 0xa
and dword [0x5d0a9f], 0xf39a85d2
dec edx
rol ecx, 0xe
dec ecx
call fcn.004e8fa9
ror ebx, 9
add eax, edx
mov dword [0x5d0c09], 0x13b35af
xor ebx, 0xe8b6d9ef
or ecx, dword [0x5d0d4d]
rol esi, 2
xor edx, dword [0x5d0e38]
xchg ecx, eax
xor dword [0x5d0bf8], 0x1045f575
call fcn.004dea32

Function at 0x52c0eb
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
cli
jg 0x52c075
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
adc eax, sym.imp.KERNEL32.dll_GetModuleHandleA
sub edx, dword [0x5d0df3]
rol edx, 0xd
or edi, dword [0x5d0d24]
add esi, eax
xor edx, edi
not edx
or ecx, dword [0x5d0f80]
or eax, 0x5d0f80
ror edi, 0x17
call fcn.00441d25
and dword [0x5d0bb8], edi
neg eax
call fcn.004e0826
neg eax
sub dword [0x5d08f9], edx
stc
or byte [ebp], bl
call fcn.00472292
rol edi, 0x17
not edx
xor edx, edi
sub esi, eax
ror edx, 0xd
add esp, 0xc
inc eax
sub edx, ecx
xchg esi, edx
call fcn.00464eb2
loope 0x52c05c
inc ecx
into
add eax, 0x9c20d21
pop ebp
add al, ch
or dword [edi - 0x3eb10003], 0xffffffc3
adc byte [ecx + 0x7d3ecef2], al
add dword [ebx], eax
xor eax, 0x5d0eb3
mov bl, 0xe
pop ebp
invalid
xchg ecx, edx
call fcn.0040ded6
xchg ecx, edx
xor edx, 0x17d3ece
ror ebx, 0x10
inc esi
call fcn.0047e3c8
mov dword [0x5d0996], esi
rol esi, 5
xchg esi, edx
add edx, ecx
dec eax
mov edx, 0xeb956be
rol eax, 0xa
and dword [0x5d0a9f], 0xf39a85d2
dec edx
rol ecx, 0xe
dec ecx
call fcn.004e8fa9
ror ebx, 9
add eax, edx
mov dword [0x5d0c09], 0x13b35af
xor ebx, 0xe8b6d9ef
or ecx, dword [0x5d0d4d]
rol esi, 2
xor edx, dword [0x5d0e38]
xchg ecx, eax
xor dword [0x5d0bf8], 0x1045f575
call fcn.004dea32
Function at 0x52c166
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
not ebx
call fcn.0042ba72
call fcn.00432823
not ebx
add dword [0x5d0990], 0xd89df653
xchg ecx, eax
ror esi, 2
xor ebx, 0xe8b6d9ef
add dword [0x5d096f], 0x2bd427c6
sub eax, edx
rol ebx, 9
call fcn.00426425
inc ecx
ror ecx, 0xe
inc edx
ror eax, 0xa
or edx, 0xb42441
not edx
xchg eax, esi
call fcn.00465c02
sub edi, dword [0x5d0c6e]
and dword [0x5d098f], ecx
ror eax, 7
sub edi, 0x9bae8686
xchg ecx, eax
ror ebx, 5
sub eax, ebp
rol eax, 0x19
neg edx
call fcn.004b6428
xchg edi, esi
or dword [0x5d0c04], ecx
add byte [ecx], al
or eax, 0x5d092a
xchg edi, esi
call fcn.004d5742
neg edx
ror eax, 0x19
add eax, ebp
rol ebx, 5
xchg ecx, eax
add edi, 0x9bae8686
rol eax, 7
call fcn.004cfd07
xchg eax, esi
not edx
add edx, 0xf1428901
not ebx
ror edx, 0x1d
xor eax, dword [0x5d0d32]
or dword [0x5d0b74], eax
dec ebx
add dword [0x5d0adf], ebx
or edx, dword [0x5d0ce4]
or dword [0x5d0aa2], esi
add edx, ebp
neg ecx
or eax, dword [0x5d0e64]
call fcn.004f61fa
neg ecx
sub edx, ebp
add dword [0x5d0b58], edi
inc ebx
or dword [0x5d0910], ecx
rol edx, 0x1d
not ebx

Function at 0x52c25c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push edx
xor dword [0x5d0b4e], edi
not esi
inc ebx
mov dword [0x5d0a06], esi
sub eax, ecx
sub ebx, dword [0x5d0f1c]
not ebx
mov dword [0x5d0bdd], ecx
call fcn.004b9822
not eax
or dword [0x5d092b], 0x77651c6f
xchg ecx, edx
add dword [0x5d0b22], ebx
xor ecx, dword [0x5d0c62]
add dword [0x5d0b82], esi
call fcn.00469c98
xor dword [0x5d097a], esi
inc edx
xchg edi, edx
sub esi, edx
add dword [0x5d0916], esi
call fcn.00547bc5
call fcn.0043ef84
add esi, edx
xchg edi, edx
dec edx
sub dword [0x5d0bdf], ebx
call fcn.004f993d
xchg ecx, edx
not eax
call fcn.004a2436
popal
idiv edi
xor dword [0x5d09da], esi
not ebx
add eax, ecx
add dword [0x5d092e], edi
dec ebx
not esi
xor dword [0x5d0bc1], ebx
mov edi, 0x78e1d98e
dec ebx
neg edx
xor edx, edi
dec esi
xchg edx, eax
call fcn.004a2436
xor esi, dword [0x5d0cd4]
sub edi, 0x9fcc7c20
call fcn.0054b7a2
inc edi
neg ebx
inc ecx
sub edi, ebp
xor esi, 0x740f91d2
xchg edi, edx
or ebx, dword [0x5d0fbc]
or eax, dword [0x5d0e8c]
xor edi, dword [0x5d0cf6]
xchg edi, edx
xor esi, 0x740f91d2
add edi, ebp
dec ecx
neg ebx
dec edi
add edi, 0x9fcc7c20
call fcn.00417ba2
xchg edx, eax
inc esi
Function at 0x52c3cd
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
fucomp st(0)
lea esp, [esi - 0xd]
inc ecx
leave
push cs