joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40caee
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x54ede1
call fcn.0053f2d9
mov ecx, dword [ebp + 8]
call fcn.00408ddf
cmp byte [0x5fdeb9], 0
jne 0x40cbdb
mov ecx, dword [ebp + 8]
call fcn.00408ddf
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x40cbee
push edi
call fcn.0053f28b
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x40cc90
cmp edi, dword [ebp - 0x18]
ja 0x40cc90
lea ecx, [ebp - 0x2c]
call fcn.0040922d
mov byte [ebp - 4], 1
test edi, edi
je 0x40cbd1
xor eax, eax
mov dword [ebp - 0x14], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x10], eax
cmp byte [esi + eax - 1], 0
jne 0x40cbc2
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00409462
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0040a296
mov edi, eax
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00408e61
mov ecx, dword [ebp + 8]
push edi
call fcn.00408d9b
push dword [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0053f294
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
jne 0x40cb76
mov edi, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp ebx, edi
jmp 0x40cc87
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40cbf5
xor al, al
jmp 0x40cc99
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040b0ae
mov esi, dword [ebp - 0x1c]
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x40cc90
cmp edi, dword [ebp - 0x18]
ja 0x40cc90
lea ecx, [ebp - 0x38]
call fcn.004093ee
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x18], edx
mov eax, ebx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x40cc82
push 2
pop ecx
mov dword [ebp - 0x14], ecx
cmp word [esi + ecx - 2], bx
jne 0x40cc71
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409599
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 0x18], eax
call fcn.00408e61
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
call fcn.00408d9b
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x10]
inc eax
add ecx, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
cmp eax, edi
jb 0x40cc3b
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x38]
cmp edx, edi
sete bl
call fcn.0053f294
pop ecx
push esi
call fcn.0053f294
mov al, bl
pop ecx
call fcn.0053f2a7
ret 4
Function at 0x40cf44
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cf6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40cf6e
xor al, al
jmp 0x40cf82
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x4173b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x4173c1
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x417407
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x4173fc
add dword [esi], edx
test eax, eax
jne 0x417407
call fcn.0040cf24
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x41e083
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ffcd
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5f7268]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.0041e135
lea ecx, [esi + 0x78]
call fcn.0041e135
push dword [esi + 0x30]
call fcn.0053f294
push dword [esi + 0x24]
call fcn.0053f294
push dword [esi + 0x18]
call fcn.0053f294
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41e0e7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x41e0fb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x41e10f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x41e122
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret

Function at 0x41e192
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54f4f0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x5f7268]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.004217db
lea ecx, [esi + 0x30]
call fcn.0041e135
push dword [esi + 0x24]
call fcn.0053f294
pop ecx
lea ecx, [esi + 0xc]
call fcn.00408d5a
mov ecx, esi
call fcn.0041e049
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x422946
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x42298b
cmp edx, 0x52
je 0x42297a
cmp ecx, 0x76
jne 0x422987
mov ecx, esi
call fcn.00422417
jmp 0x422992
test al, al
je 0x422987
mov ecx, esi
call fcn.004233d8
jmp 0x422992
xor al, al
jmp 0x422994
mov ecx, esi
call fcn.00422c1c
mov al, 1
pop esi
pop ebp
ret 4

Function at 0x42477e
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x10]
push eax
push 0x64
push 0x66
call fcn.00424892
lea eax, [edi + 0x38]
mov ecx, edi
push eax
push 0x65
push 0x67
call fcn.00424892
mov ecx, edi
call fcn.0040b464
cmp byte [edi + 9], 0
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
jne 0x4247e5
push 0x1b8
push dword [edi + 4]
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1b9
push dword [edi + 4]
call ebx
push 0
push eax
call esi
push 0xdb1
push dword [edi + 4]
call ebx
push 0
push eax
call esi
cmp byte [edi + 0xa], 0
je 0x424810
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 7
push 0x401
push dword [edi + 4]
call esi
push 7
push dword [edi + 4]
call ebx
push 1
push eax
push 0x28
push dword [edi + 4]
call esi
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x424892
Capabilities:
Get file system object information

Disassembly:
push 0x1f4
mov eax, 0x550a60
call fcn.0053f30c
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1f4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c4], eax
call fcn.004093ee
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x424917
push dword [edi + 0xc]
lea eax, [ebp - 0x200]
push dword [edi + 8]
push eax
call fcn.00424701
push eax
push 0xdb0
lea eax, [ebp - 0x1d0]
mov byte [ebp - 4], 1
push eax
call fcn.004246c2
push eax
lea ecx, [ebp - 0x1f4]
mov byte [ebp - 4], 2
call fcn.004094b9
push dword [ebp - 0x1d0]
call fcn.0053f294
push dword [ebp - 0x200]
mov byte [ebp - 4], 0
call fcn.0053f294
pop ecx
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1c0], eax
call fcn.00409f3e
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1e8]
call fcn.00409295
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x1dc]
add eax, 2
mov byte [ebp - 4], 3
lea eax, [eax + esi*2]
push eax
call fcn.004093b8
lea eax, [ebp - 0x1e8]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00424816
lea eax, [ebp - 0x1dc]
mov ecx, ebx
push eax
call fcn.00424816
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0040931a
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 5
call fcn.004097b1
lea eax, [ebp - 0x1dc]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0040968b
lea ecx, [ebp - 0x1bc]
call fcn.004097b1
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0040968b
lea ecx, [ebp - 0x1bc]
call fcn.004097b1
cmp byte [edi + 1], 0
je 0x424a15
push 0x3f4
lea eax, [ebp - 0x1bc]
push eax
call fcn.00423879
push 0x5537d4
lea ecx, [ebp - 0x1bc]
call fcn.004096c9
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0040df85
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.004096c9
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x1bc]
push eax
call fcn.0040e8bd
push 0
push dword [ebp - 0x1c0]
lea eax, [ebp - 0x1d0]
push eax
call fcn.0040a508
push 0x110
push 0x160
lea eax, [ebp - 0x1b0]
push eax
push 0x80
push dword [ebp - 0x1d0]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1d0]
mov esi, eax
call fcn.0053f294
pop ecx
test esi, esi
je 0x424a96
push dword [ebp - 0x1c4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x1b0]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x1bc]
call fcn.0053f294
push dword [ebp - 0x1dc]
call fcn.0053f294
push dword [ebp - 0x1e8]
call fcn.0053f294
push dword [ebp - 0x1f4]
call fcn.0053f294
add esp, 0x10
call fcn.0053f2bb
ret 0xc
Function at 0x42a9dd
Capabilities:
Hide graphical window

Disassembly:
push 0x44
mov eax, 0x550cfb
call fcn.0053f2d9
mov ebx, ecx
push 0
call fcn.0042b67d
push 1
mov ecx, ebx
call fcn.0042bbd2
push 0x198
lea eax, [ebp - 0x20]
push eax
call fcn.0040e049
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 2
push dword [ebx + 4]
call edi
push esi
push eax
call fcn.0040e8bd
push dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
call fcn.0053f294
pop ecx
push 1
push 1
push 0xf4
push 2
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x1bc
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0x1be
push dword [ebx + 4]
call edi
push 0
push eax
call esi
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x38]
lea ecx, [ebp - 0x50]
call fcn.0042514e
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 1
call fcn.0042514e
lea esi, [ebx + 0x210]
mov dword [ebp - 4], 2
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1d8]
lea edi, [ebx + 0x1e0]
push edi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
mov dword [ebp - 0x10], eax
call fcn.00425421
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00425421
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x40], 0
je 0x42ab07
cmp dword [ebp - 0x4c], 0
mov byte [ebx + 0x22b], 1
jne 0x42aaf4
push str.7_Zip
lea ecx, [ebp - 0x50]
call fcn.00409520
cmp byte [0x5fdeb8], 0
jne 0x42ab6f
push 0x10
push dword [ebp - 0x50]
push dword [ebp - 0x44]
jmp 0x42ab3d
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42ab49
mov byte [ebx + 0x22b], 1
cmp dword [ebp - 0x28], eax
je 0x42ab49
cmp dword [ebp - 0x34], eax
jne 0x42ab2c
push str.7_Zip
lea ecx, [ebp - 0x38]
call fcn.00409520
cmp byte [0x5fdeb8], 0
jne 0x42ab6f
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x2c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x10]
cmp byte [0x5fdeb8], 0
jne 0x42ab6f
test eax, eax
je 0x42ab6f
cmp byte [ebx + 0x160], 0
jne 0x42ab6f
mov ecx, ebx
mov byte [ebx + 0x155], 1
call fcn.0042ba5e
jmp 0x42ab7a
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EndDialog]
lea ecx, [ebp - 0x50]
call fcn.0042539f
mov al, 1
call fcn.0053f2a7
ret
Function at 0x42aed7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov eax, dword [edx]
lea esi, [edi + 0xb4]
cmp eax, dword [esi]
jne 0x42af0a
cmp dword [edx + 8], 0xffffff65
jne 0x42af0a
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x42af2c
sub eax, 0x14
je 0x42af12
dec eax
sub eax, 1
je 0x42af2c
xor al, al
pop edi
pop esi
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x42af0a
mov ecx, esi
call fcn.0042b4c4
mov al, 1
jmp 0x42af0c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x42af0a
mov ecx, edi
call fcn.0042573f
jmp 0x42af28

Function at 0x42c998
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x5f7268]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5fdeb9], 0
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
jne 0x42ca05
push esi
push edx
lea eax, [ebp - 0x2c4]
push eax
call fcn.0040a2d8
push 0x4010
push 0x160
lea ecx, [ebp - 0x164]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x2c4]
mov esi, eax
call fcn.0053f294
pop ecx
mov ecx, dword [ebp - 0x160]
mov eax, esi
pop esi
jmp 0x42ca32
mov eax, dword [0x5fdeb0]
test eax, eax
je 0x42ca2c
push 0x4010
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp + 0xc]
or ecx, 0x80
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x2b4]
mov dword [edi], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0053f016
leave
ret 0xc

Function at 0x42ca43
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x5f7268]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 8]
mov edx, 0x4011
test al, al
mov ecx, 0x4110
lea eax, [ebp - 0x164]
cmovne ecx, edx
push ecx
push 0x160
push eax
push 0x90
push 0x552720
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f016
leave
ret 4
Function at 0x42df20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55114d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5f7268]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.0053f24d
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x42df6b
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x42df6d
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x42dfd0
push 0
push 0
call fcn.005445b3
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x42dfb4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f016
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.00540916
int3
Function at 0x47de70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55114d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5f7268]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
call fcn.0053f24d
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x47debb
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
jmp 0x47debd
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x47df20
push 0
push 0
call fcn.005445b3
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x47df04
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f016
mov esp, ebp
pop ebp
ret 8
push 6
mov dword [edi], 0
call fcn.00540916
int3
Function at 0x525450
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea esi, [ebp - 0x12c]
xor bl, bl
mov edi, 0x10
nop dword [eax]
movzx edx, bl
lea esi, [esi + 4]
add edx, ecx
add bl, 4
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
mov dword [esi - 4], ecx
mov ecx, dword [ebp - 4]
sub edi, 1
jne 0x525470
lea eax, [ebp - 0x128]
mov ebx, 0x30
nop
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x5254b0
mov ebx, dword [ebp - 4]
add ebx, 0x50
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0x40
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [ebp - 0x14], xmm0
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov edi, ebx
mov esi, dword [ebp - 0x20]
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror edi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor edi, eax
mov eax, ebx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x10]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 4]
add edi, ecx
add dword [ebp - 4], 4
add edi, dword [eax + 0x557438]
add edi, dword [ebp + eax - 0x12c]
add edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, edx
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
add ebx, edi
mov eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov ecx, eax
mov dword [ebp - 0x20], eax
rol eax, 0xa
ror ecx, 0xd
xor ecx, eax
mov eax, dword [ebp - 0x24]
ror eax, 2
xor ecx, eax
mov eax, esi
or eax, edx
and esi, edx
and eax, dword [ebp - 0x24]
add ecx, edi
or eax, esi
add eax, ecx
sub dword [ebp - 0x28], 1
mov dword [ebp - 0x24], eax
jne 0x525513
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp - 0x2c]
mov edx, 8
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x5255b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5256b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
xor eax, eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp + 0xc], eax
jbe 0x525877
mov edx, dword [ebp + 8]
push esi
push edi
mov ecx, dword [ebx + 0x40]
mov al, byte [eax + edx]
mov byte [ebx + ecx], al
inc dword [ebx + 0x40]
cmp dword [ebx + 0x40], 0x40
jne 0x525865
xor al, al
lea esi, [ebp - 0x138]
mov byte [ebp - 1], al
mov edi, 0x10
nop dword [eax + eax]
movzx ecx, al
lea esi, [esi + 4]
movzx eax, byte [ecx + ebx]
add ecx, ebx
shl eax, 8
movzx edx, byte [ecx + 1]
or edx, eax
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 3]
shl edx, 8
or edx, eax
mov al, byte [ebp - 1]
add al, 4
mov dword [esi - 4], edx
mov byte [ebp - 1], al
sub edi, 1
jne 0x525700
lea eax, [ebp - 0x134]
lea ebx, [edi + 0x30]
mov edx, dword [eax]
lea eax, [eax + 4]
mov esi, dword [eax + 0x30]
mov edi, edx
mov ecx, edx
rol edi, 0xe
ror ecx, 7
xor edi, ecx
shr edx, 3
xor edi, edx
mov ecx, esi
mov edx, esi
rol ecx, 0xd
rol edx, 0xf
xor edx, ecx
shr esi, 0xa
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x525740
mov ebx, dword [ebp - 0x30]
add ebx, 0x50
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], 0x40
movups xmm0, xmmword [ebx]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [ebp - 0x18], xmm0
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov edi, ebx
mov esi, dword [ebp - 0x24]
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror edi, 0xb
not ecx
and ecx, dword [ebp - 0x10]
xor edi, eax
mov eax, ebx
ror eax, 6
xor edi, eax
mov eax, dword [ebp - 0x14]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 8]
add edi, ecx
add dword [ebp - 8], 4
add edi, dword [eax + 0x557438]
add edi, dword [ebp + eax - 0x138]
add edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
add ebx, edi
mov eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov dword [ebp - 0x24], eax
rol eax, 0xa
ror ecx, 0xd
xor ecx, eax
mov eax, dword [ebp - 0x28]
ror eax, 2
xor ecx, eax
mov eax, esi
or eax, edx
and esi, edx
and eax, dword [ebp - 0x28]
add ecx, edi
or eax, esi
add eax, ecx
sub dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], eax
jne 0x5257a3
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x38]
mov edx, 8
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add dword [ebx], eax
lea ebx, [ebx + 4]
sub edx, 1
jne 0x525843
mov ebx, dword [ebp - 0x30]
add dword [ebx + 0x48], 0x200
mov dword [ebx + 0x40], edx
adc dword [ebx + 0x4c], edx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp + 0xc]
jb 0x5256d2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8