joyce8/EMBER2024-capa huggingface dataset:
Function at 0x66c300
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.004b0160
dec eax
cmp eax, 9
ja case.default.0x66c317
jmp dword [eax*4 + 0x66c50c]
lea esi, [esp + 4]
mov ecx, esi
push 0x11f
push 0x8d4080
push 3
call fcn.00630740
mov ecx, esi
push str.Unsupported
call fcn.0062ff70
mov ecx, esp
push eax
call fcn.006300f0
mov ecx, esi
call fcn.00630770
lea esi, [esp + 4]
mov ecx, esi
push 0x137
push 0x8d4080
push 3
call fcn.00630740
mov ecx, esi
push 0x8d401c
call fcn.0062ff70
mov ecx, esp
push eax
call fcn.006300f0
mov ecx, esi
call fcn.00630770
xor eax, eax
jmp 0x66c502
mov ecx, esi
call fcn.004a95f0
mov ecx, esi
call fcn.004a95f0
jmp 0x66c502
mov ecx, esi
call fcn.004a9530
jmp 0x66c3c6
mov ecx, esi
call fcn.004a9770
mov ecx, esi
call fcn.004a9770
jmp 0x66c502
mov ecx, esi
call fcn.004a96b0
mov ecx, esi
call fcn.004a96b0
imul eax, eax, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0xde8f4ca8
imul ecx, edx, 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul ecx, edx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
jmp 0x66c4fb
mov ecx, esi
call fcn.004a9470
movzx ebx, byte [eax]
test bl, 1
je 0x66c43d
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp ebx, 4
jae 0x66c445
mov ecx, ebx
mov edx, ebx
jmp 0x66c4c2
mov ecx, esi
call fcn.004a9830
movzx eax, al
jmp 0x66c502
inc eax
shr ebx, 1
cmp ebx, 4
jb 0x66c425
lea edx, [ebx - 4]
test dl, 4
jne 0x66c46f
imul ecx, dword [eax], 0x5bd1e995
mov esi, ecx
shr esi, 0x18
xor esi, ecx
imul esi, esi, 0x5bd1e995
imul ecx, ebx, 0x5bd1e995
xor ecx, esi
add eax, 4
mov ebx, edx
jmp 0x66c471
mov ecx, ebx
cmp edx, 4
jb 0x66c4c2
mov edx, ebx
nop dword [eax + eax]
imul esi, dword [eax], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
imul esi, dword [eax + 4], 0x5bd1e995
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, esi
add eax, 8
add edx, 0xfffffff8
cmp edx, 3
ja 0x66c480
cmp edx, 1
je 0x66c4e3
cmp edx, 2
je 0x66c4da
cmp edx, 3
jne 0x66c4ee
movzx edx, byte [eax + 2]
shl edx, 0x10
xor ecx, edx
movzx edx, byte [eax + 1]
shl edx, 8
xor ecx, edx
movzx eax, byte [eax]
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 4
Function at 0x66cac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
cmp eax, 1
jne 0x66caf9
mov dword [esi + 0xc], 8
mov dword [esi + 4], 8
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x66cb25
mov eax, dword [0x8d4690]
push eax
push 0x20
call fcn.0052c1e0
jmp 0x66cb2f
mov ebx, dword [esp + 0x2c]
mov eax, dword [esi + 0x10]
mov dword [esp], eax
mov ecx, dword [esi + 0x14]
mov dword [esi + 4], ebx
shl ebx, 2
test ecx, ecx
je 0x66cb49
lea eax, [ebx + 7]
and eax, 0xfffffff8
mov edx, dword [0x8d4690]
push edx
push eax
call fcn.0052c1e0
jmp 0x66cb52
push 0x20
call fcn.0051c3d0
add esp, 4
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [esi + 0x10], eax
mov eax, esi
shr eax, 4
mov dword [esi + 8], eax
jmp 0x66cbff
push ebx
call fcn.0051c3d0
add esp, 4
mov edi, eax
push ebx
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esi + 0x10], edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov dword [esi + 0xc], eax
cmp edi, dword [esp + 4]
mov edx, dword [esp]
jae 0x66cbf0
lea ebp, [esp + 0xc]
jmp 0x66cb95
mov ecx, esi
push edi
inc edi
push edx
mov ebx, edx
call fcn.0066cc10
mov edx, ebx
inc edi
cmp edi, dword [esp + 4]
jae 0x66cbf0
mov ebx, dword [edx + edi*4]
test ebx, ebx
je 0x66cb8e
mov eax, edi
xor eax, 1
cmp ebx, dword [edx + eax*4]
je 0x66cb80
mov dword [esp + 8], edi
nop word [eax + eax]
mov edi, dword [ebx + 0x20]
mov ecx, esi
push ebx
call fcn.0066c300
mov ecx, eax
xor ecx, dword [esi + 8]
mov eax, ecx
mov edx, 0x7f4a7c15
mul edx
imul eax, ecx, 0x9e3779b9
add eax, edx
mov edx, dword [esi + 4]
dec edx
and edx, eax
mov ecx, ebp
push ebx
push edx
push esi
call fcn.0066c9f0
mov ebx, edi
test edi, edi
jne 0x66cbb0
mov edx, dword [esp]
mov edi, dword [esp + 8]
jmp 0x66cb8e
cmp dword [esi + 0x14], 0
jne 0x66cbff
push edx
call fcn.0051c570
add esp, 4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x674b40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
lea ebx, [ebp + ecx]
mov edi, dword [eax]
lea eax, [edi*4 + 4]
push eax
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
cmp dword [esp + 0x20], 0
je 0x674cb0
mov ecx, dword [esp + 0x18]
jle 0x674b8c
nop
movzx eax, byte [ebp]
inc ebp
inc dword [esi + eax*4]
cmp ebp, ebx
jb 0x674b80
inc edi
nop dword [eax]
cmp dword [esi + edi*4 - 4], 0
lea edi, [edi - 1]
je 0x674b90
mov dword [ecx], edi
lea edx, [edi + 1]
xor ecx, ecx
mov eax, 0
cmp edx, 8
jb 0x674c98
mov ecx, edx
and ecx, 0xfffffff8
mov eax, edx
and eax, 0xfffffff8
pxor xmm1, xmm1
xor ebx, ebx
movdqa xmm0, xmmword [0x8d7570]
pxor xmm2, xmm2
nop dword [eax + eax]
movdqu xmm4, xmmword [esi + ebx*4]
movdqu xmm3, xmmword [esi + ebx*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm4
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm4, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm5, xmm3
pxor xmm5, xmm0
pcmpgtd xmm5, xmm4
pand xmm3, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm3
add ebx, 8
cmp eax, ebx
jne 0x674bd0
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
pshufd xmm2, xmm1, 0x55
movdqa xmm3, xmm1
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm3, xmm0
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
movd eax, xmm3
cmp edx, ecx
je 0x674cbc
dec ecx
nop dword [eax]
mov edx, dword [esi + ecx*4 + 4]
cmp edx, eax
cmova eax, edx
inc ecx
cmp ecx, edi
jb 0x674ca0
jmp 0x674cbc
mov eax, dword [esp + 0x18]
mov dword [eax], 0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x674cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp edi, 0x5db
ja 0x674e36
mov ebx, dword [edx]
lea eax, [ebx*4 + 4]
push eax
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
test edi, edi
je 0x674e64
mov ecx, dword [esp + 0x18]
add edi, ebp
nop word cs:[eax + eax]
movzx eax, byte [ebp]
inc ebp
inc dword [esi + eax*4]
cmp ebp, edi
jb 0x674d20
inc ebx
nop dword [eax]
cmp dword [esi + ebx*4 - 4], 0
lea ebx, [ebx - 1]
je 0x674d30
mov dword [ecx], ebx
inc ebx
xor ecx, ecx
mov eax, 0
cmp ebx, 8
jb 0x674e72
mov ecx, ebx
and ecx, 0xfffffff8
pxor xmm1, xmm1
xor eax, eax
movdqa xmm0, xmmword [0x8d7580]
pxor xmm2, xmm2
nop word cs:[eax + eax]
movdqu xmm4, xmmword [esi + eax*4]
movdqu xmm3, xmmword [esi + eax*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm4
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm4, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm5, xmm3
pxor xmm5, xmm0
pcmpgtd xmm5, xmm4
pand xmm3, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm3
add eax, 8
cmp ecx, eax
jne 0x674d70
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
pshufd xmm2, xmm1, 0x55
movdqa xmm3, xmm1
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm3, xmm0
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
movd eax, xmm3
jmp 0x674e7b
mov ebx, dword [esp + 0x24]
mov eax, 0xffffffff
test bl, 3
jne 0x674e7f
mov eax, 0xffffffbe
cmp dword [esp + 0x28], 0x1000
jb 0x674e7f
mov ecx, esi
push ebx
push 0
push edi
push ebp
call fcn.00674e90
add esp, 0x10
jmp 0x674e7f
mov eax, dword [esp + 0x18]
mov dword [eax], 0
xor eax, eax
jmp 0x674e7f
mov edx, dword [esi + ecx*4]
cmp edx, eax
cmova eax, edx
inc ecx
cmp ebx, ecx
jne 0x674e72
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6751d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x24]
mov eax, 0xffffffff
test cl, 3
jne 0x675379
mov eax, 0xffffffbe
cmp dword [esp + 0x28], 0x1000
jb 0x675379
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp dword [edi], 0xfe
ja 0x67521f
mov eax, ecx
mov ecx, esi
mov edx, edi
push eax
push 1
jmp 0x67536f
mov dword [edi], 0xff
cmp ebp, 0x5db
ja 0x675366
push 0x400
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
test ebp, ebp
je 0x67537e
add ebp, ebx
nop dword [eax + eax]
movzx eax, byte [ebx]
inc ebx
inc dword [esi + eax*4]
cmp ebx, ebp
jb 0x675250
mov ecx, 0x101
cmp dword [esi + ecx*4 - 8], 0
lea ecx, [ecx - 1]
je 0x675260
lea eax, [ecx - 1]
mov dword [edi], eax
xor edx, edx
mov eax, 0
cmp ecx, 8
jb 0x675388
mov edx, ecx
and edx, 0xfffffff8
pxor xmm1, xmm1
xor eax, eax
movdqa xmm0, xmmword [0x8d75a0]
pxor xmm2, xmm2
nop word cs:[eax + eax]
movdqu xmm4, xmmword [esi + eax*4]
movdqu xmm3, xmmword [esi + eax*4 + 0x10]
movdqa xmm5, xmm1
pxor xmm5, xmm0
movdqa xmm6, xmm4
pxor xmm6, xmm0
pcmpgtd xmm6, xmm5
pand xmm4, xmm6
pandn xmm6, xmm1
movdqa xmm1, xmm6
por xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm5, xmm3
pxor xmm5, xmm0
pcmpgtd xmm5, xmm4
pand xmm3, xmm5
pandn xmm5, xmm2
movdqa xmm2, xmm5
por xmm2, xmm3
add eax, 8
cmp edx, eax
jne 0x6752a0
movdqa xmm4, xmm2
pxor xmm4, xmm0
movdqa xmm3, xmm1
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
pshufd xmm2, xmm1, 0x55
movdqa xmm3, xmm1
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm3, xmm0
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
movd eax, xmm3
jmp 0x675391
mov eax, ecx
mov ecx, esi
mov edx, edi
push eax
push 0
push ebp
push ebx
call fcn.00674e90
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [edi], 0
xor eax, eax
jmp 0x675379
mov edi, dword [esi + edx*4]
cmp edi, eax
cmova eax, edi
inc edx
cmp ecx, edx
jne 0x675388
jmp 0x675379
Function at 0x68d560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
movzx ecx, byte [edx + 0xac]
mov esi, 0xffffffff
shl esi, cl
mov dword [esp + 0xc], esi
mov ecx, dword [edx + 4]
mov esi, eax
mov dword [esp + 4], ecx
sub esi, ecx
mov eax, dword [edx + 0xb8]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0xb0]
mov dword [esp], eax
mov ebp, dword [edx + 0x1c]
mov dword [esp + 0x10], esi
cmp ebp, esi
jae 0x68d6d3
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 0x54]
mov dword [esp + 0x20], eax
not dword [esp + 0xc]
mov ebx, 0x40
mov eax, dword [esp]
sub ebx, eax
mov ecx, 0x20
sub ecx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 8]
add eax, 0xfffffffb
mov dword [esp + 0x1c], eax
jmp 0x68d64d
mov edx, dword [esp + 4]
mov eax, dword [edx + ebp]
mov ecx, 0xb7a56463
add ecx, 0x35a9b9d
mov esi, 0xcf1bbcdc
adc esi, 0
mov edi, dword [edx + ebp + 4]
imul edi, ecx
imul esi, eax
mul ecx
add edx, esi
add edx, edi
mov ecx, ebx
shrd eax, edx, cl
shr edx, cl
test bl, 0x20
cmove edx, eax
mov esi, dword [esp + 0x14]
mov eax, dword [esi + edx*4]
mov ecx, ebp
and ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x20]
mov dword [edi + ecx*4], eax
mov dword [esi + edx*4], ebp
inc ebp
cmp ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
jae 0x68d6d3
cmp eax, 3
ja case.default.0x68d652
jmp dword [eax*4 + 0x8d825c]
mov edx, dword [esp + 4]
mov eax, dword [edx + ebp]
mov ecx, 0xb7a56463
add ecx, 0x7f59b9d
jmp 0x68d602
mov edx, dword [esp + 4]
mov eax, dword [edx + ebp]
mov ecx, 0xb7a56463
add ecx, 0x7fffe9d
jmp 0x68d602
mov esi, dword [esp + 4]
mov eax, dword [esi + ebp]
mov ecx, eax
mov edx, 0xb7a56463
mul edx
mov edi, 0xcf1bbcdc
imul ecx, edi
add edx, ecx
mov ecx, dword [esi + ebp + 4]
mov esi, 0xb7a56463
imul ecx, esi
add edx, ecx
jmp 0x68d61a
mov eax, dword [esp + 4]
imul edx, dword [eax + ebp], 0x9e3779b1
mov ecx, dword [esp + 0x18]
shr edx, cl
jmp 0x68d627
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x1c], ecx
mov eax, dword [esp + 8]
add eax, 0xfffffffb
cmp eax, 3
ja case.default.0x68d6ea
jmp dword [eax*4 + 0x8d826c]
mov ebx, dword [esp + 0x3c]
mov ecx, dword [ebx]
mov esi, 0xb7a56463
add esi, 0x35a9b9d
jmp 0x68d73b
mov eax, dword [esp + 0x3c]
imul esi, dword [eax], 0x9e3779b1
mov ecx, dword [esp]
neg cl
shr esi, cl
jmp 0x68d781
mov ebx, dword [esp + 0x3c]
mov ecx, dword [ebx]
mov esi, 0xb7a56463
add esi, 0x7f59b9d
jmp 0x68d73b
mov ebx, dword [esp + 0x3c]
mov ecx, dword [ebx]
mov esi, 0xb7a56463
add esi, 0x7fffe9d
mov edi, 0xcf1bbcdc
adc edi, 0
mov eax, ecx
mul esi
imul edi, ecx
add edi, edx
imul esi, dword [ebx + 4]
add esi, edi
jmp 0x68d771
mov edi, dword [esp + 0x3c]
mov eax, dword [edi]
mov ecx, 0xcf1bbcdc
imul ecx, eax
mov esi, 0xb7a56463
mul esi
add edx, ecx
imul esi, dword [edi + 4]
add esi, edx
mov cl, 0x40
sub cl, byte [esp]
shrd eax, esi, cl
shr esi, cl
test cl, 0x20
cmove esi, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + esi*4]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6f50c0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x6f50f8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x6f50ee
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x6f50fa
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x6f50e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x708520
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [0x9b7450]
xor eax, eax
test esi, esi
je 0x708637
mov ebx, dword [esi + 4]
test ebx, ebx
je 0x708637
imul eax, dword [esp + 0x18], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, dword [esp + 0x1c]
xor ecx, eax
mov eax, ebx
shr eax, 1
and eax, 0x55555555
mov edx, ebx
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul ebp, eax, 0x1010101
shr ebp, 0x18
cmp ebp, 1
ja 0x7085b2
lea edi, [ebx - 1]
and edi, ecx
jmp 0x7085c4
mov edi, ecx
cmp ecx, ebx
mov edx, dword [esp + 0x18]
jb 0x7085c8
mov eax, ecx
xor edx, edx
div ebx
mov edi, edx
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
test eax, eax
je 0x708635
mov esi, dword [eax]
test esi, esi
mov eax, 0
je 0x708637
lea eax, [ebx - 1]
mov dword [esp], eax
jmp 0x7085fd
and eax, dword [esp]
cmp eax, edi
jne 0x708635
mov esi, dword [esi]
test esi, esi
je 0x708635
mov eax, dword [esi + 4]
cmp ecx, eax
jne 0x708620
cmp dword [esi + 8], edx
jne 0x7085f7
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0xc], eax
jne 0x7085f7
jmp 0x708641
cmp ebp, 1
jbe 0x7085f0
cmp eax, ebx
jb 0x7085f3
xor edx, edx
div ebx
mov eax, edx
mov edx, dword [esp + 0x18]
jmp 0x7085f3
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8
movzx eax, byte [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [0x8841ac]
mov eax, dword [edx + eax*4]
lea edx, [eax - 5]
xor edi, edi
cmp edx, 0xfffffffd
mov edx, 0
cmovb edx, ecx
cmp byte [esi + 0x11], 0
cmove edx, edi
cmp eax, 2
mov eax, edx
cmove eax, ecx
jmp 0x708637
Function at 0x710370
Capabilities:
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [0x9b7450]
test ebx, ebx
je 0x710475
mov edi, dword [ebx + 4]
test edi, edi
je 0x710475
imul eax, dword [esp + 0x20], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
xor eax, 0x6f47a654
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0xf
xor ecx, dword [esp + 0x1c]
xor ecx, eax
mov eax, edi
shr eax, 1
and eax, 0x55555555
mov edx, edi
sub edx, eax
mov eax, edx
and eax, 0x33333333
shr edx, 2
and edx, 0x33333333
add edx, eax
mov eax, edx
shr eax, 4
add eax, edx
and eax, 0xf0f0f0f
imul ebp, eax, 0x1010101
shr ebp, 0x18
cmp ebp, 1
ja 0x710400
lea esi, [edi - 1]
and esi, ecx
jmp 0x71040e
mov esi, ecx
cmp ecx, edi
jb 0x71040e
mov eax, ecx
xor edx, edx
div edi
mov esi, edx
mov eax, dword [ebx]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x710475
mov ebx, dword [eax]
test ebx, ebx
je 0x710475
lea eax, [edi - 1]
mov dword [esp], eax
mov edx, dword [esp + 0x20]
jmp 0x71043d
and eax, dword [esp]
cmp eax, esi
jne 0x710475
mov ebx, dword [ebx]
test ebx, ebx
je 0x710475
mov eax, dword [ebx + 4]
cmp ecx, eax
jne 0x710460
cmp dword [ebx + 8], edx
jne 0x710437
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0xc], eax
jne 0x710437
jmp 0x710481
cmp ebp, 1
jbe 0x710430
cmp eax, edi
jb 0x710433
xor edx, edx
div edi
mov eax, edx
mov edx, dword [esp + 0x20]
jmp 0x710433
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
movups xmm0, xmmword [ebx + 8]
movups xmm1, xmmword [ebx + 0x14]
mov edi, dword [esp + 0x28]
movups xmmword [edi], xmm0
movups xmmword [edi + 0xc], xmm1
movzx eax, byte [edi + 8]
mov ecx, dword [0x8841ac]
mov eax, dword [ecx + eax*4]
mov edx, dword [esp + 0x2c]
mov byte [edx], 0
mov esi, dword [esp + 0x18]
cmp esi, 2
jne 0x7104c6
cmp byte [edi + 9], 0
je 0x7104c6
lea ecx, [eax - 5]
cmp ecx, 0xfffffffc
ja 0x7104c6
mov byte [edx], 1
mov al, 1
jmp 0x710477
cmp eax, esi
sete al
jmp 0x710477
Function at 0x7359f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
push 0x5c
call sym.adb.exe_OPENSSL_malloc
add esp, 4
mov esi, eax
test eax, eax
je 0x735ae5
mov eax, dword [esp + 0x10]
mov edi, dword [eax]
mov eax, dword [edi]
mov dword [esi], eax
mov dword [esi + 4], 0
mov word [esi + 8], 0
movzx eax, word [edi + 0xa6]
mov word [esi + 0xa], ax
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 0
mov eax, dword [edi + 0x88]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0x3e8
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ebx, [edi + 0x4c]
push ebx
call sym.adb.exe_CRYPTO_refcount_inc
add esp, 4
mov dword [esi + 0x34], edi
push ebx
call sym.adb.exe_CRYPTO_refcount_inc
add esp, 4
mov dword [esi + 0x38], edi
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 0x78]
mov dword [esi + 0x40], ecx
mov ecx, dword [eax + 0x7c]
mov dword [esi + 0x44], ecx
mov ecx, dword [eax + 0x80]
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
movzx ecx, byte [esi + 0x58]
mov edx, ecx
and dl, 0xfe
mov byte [esi + 0x58], dl
movzx edx, byte [eax + 0x128]
and dl, 2
and cl, 0xfc
or cl, dl
mov byte [esi + 0x58], cl
movzx eax, byte [eax + 0x129]
and al, 4
and cl, 0xfa
or cl, al
mov byte [esi + 0x58], cl
mov eax, esi
add eax, 0x3c
push eax
call sym.adb.exe_CRYPTO_new_ex_data
add esp, 4
jmp 0x735afd
push 0xc6
push 0x913164
push 0x41
push 0
push 0x10
call sym.adb.exe_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x745580
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x10020
call fcn.00526390
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
je 0x7455e7
lea ebx, [ebp + 0xc]
lea edi, [esp + 0x1e]
push 0xfffe
push 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 8], 0
mov eax, esp
push eax
push dword [ebx]
call fcn.004bc490
add esp, 8
test al, al
je 0x74563b
test byte [esp], 1
je 0x7455f0
mov eax, dword [esp + 8]
jmp 0x7455f4
mov byte [esi], 0
mov byte [esi + 0xc], 0
jmp 0x745654
lea eax, [esp + 2]
push 0xfffe
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x74563b
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
lea ebx, [esp + 0x10]
push ebx
push edi
call fcn.004bc1c0
add esp, 8
test al, al
je 0x74565e
mov ecx, esi
push ebx
call fcn.0051f860
mov al, 1
jmp 0x745663
mov byte [esi], 0
mov byte [esi + 0xc], 0
test byte [esp], 1
je 0x745654
push dword [esp + 8]
call fcn.0051c570
add esp, 4
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi], 0
xor eax, eax
mov byte [esi + 0xc], al
test byte [esp + 0x10], 1
je 0x745642
push dword [esp + 0x18]
call fcn.0051c570
add esp, 4
jmp 0x745642
Function at 0x745680
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x38], str.COMPUTERNAME
mov dword [esp + 0x3c], 0xc
sub esp, 0xc
movsd xmm0, qword [esp + 0x44]
movsd qword [esp + 4], xmm0
lea edi, [esp + 0x2c]
mov dword [esp], edi
call fcn.00745580
add esp, 0xc
cmp byte [esp + 0x2c], 0
je 0x7456ef
movzx eax, byte [esp + 0x20]
test al, 1
je 0x7456e9
mov eax, dword [esp + 0x24]
test eax, eax
je 0x7456ef
mov ecx, esi
push edi
call fcn.0051f860
jmp 0x745799
shr eax, 1
test eax, eax
jne 0x7456dc
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0xc], 0x20
lea eax, [esp + 0xc]
lea edi, [esp + 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x74575c
cmp dword [esp + 0xc], 0
je 0x74575c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004bc1c0
add esp, 8
test al, al
je 0x745772
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x10]
movsd qword [esi], xmm0
jmp 0x745799
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
jmp 0x745799
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
test byte [esp + 0x10], 1
je 0x745799
push dword [esp + 0x18]
call fcn.0051c570
add esp, 4
cmp byte [esp + 0x2c], 0
je 0x7457b3
test byte [esp + 0x20], 1
je 0x7457b3
push dword [esp + 0x28]
call fcn.0051c570
add esp, 4
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret