joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0xc37bc6
Capabilities:
Encode data using xor

Disassembly:
inc edi
lea edi, [edi + esi - 0x346a0949]
dec ecx
inc ecx
js 0xcdc094
inc ecx
rol edi, 2
dec esp
xadd ebx, ecx
dec esi
mov dword [esp + ecx - 0x2bfa], eax
dec edx
mov dword [esp + ecx - 0x2c02], eax
inc esi
xor dword [esp + ecx*2 - 0x57fc], edi
dec eax
lea ecx, [eax*2 - 0x3e403af3]
dec edx
not dword [esp + ecx - 0x2c02]
imul eax
dec esp
mov eax, dword [esp + edi*8 - 0x16008]
dec eax
lea esi, [edx*8 + 0x2c0fd23a]
and si, ax
inc edx
xchg byte [esp + ecx*2 - 0x5802], dl
dec ebp
arpl di, di
dec esi
and esi, dword [esp + ecx - 0x2c02]
dec ebp
adc ebp, edi
cbw
dec edx
xchg dword [esp + ecx*2 - 0x5804], esi
xor al, 0xd
dec esi
lea esp, [esp + ecx*2 - 0x57b4]
inc edx
setp byte [esp + ecx*8 - 0x1600c]
inc ecx
pop ecx
inc eax
movsx ebp, dh
inc bx
movzx ecx, byte [esp + ecx - 0x2c0f0000]
inc ecx
xor edi, ecx
inc ebp
movzx edi, cx
dec eax
mov dword [esp + eax - 0x4000d], ebx
inc bx
mov dword [ecx + edx - 0x2c0f0004], ecx
cdq
dec ebp
lea edx, [edx + edi - 0x2c0f2c06]
dec eax
cwde
pop esi
jg fcn.00d060e3
mov ecx, 0x433071ac
mov dx, word [ebp + ecx - 0x433071ac]
sar cl, 0xe2
ja 0xccc6a2
inc ecx
mov esi, 0xdcb85897
inc ebp
movzx ecx, si
dec ecx
ror ecx, 0x29
dec ebp
mov edi, edx
inc ebp
movzx esp, dh
inc ecx
movzx eax, dh
dec edi
mov dword [edx - 0x136], edi
dec edx
lea esi, [0x6cbd573b]
inc edi
mov esi, dword [esp + ebx - 0x97]
inc ebp
xor esi, eax
mov edi, 0x6f136a29
dec ax
inc ecx
dec esi
shr si, 0x8b
inc ecx
not esi
inc ecx
rol esi, 1
movsx ecx, di
inc ecx
not esi
inc cx
ror esp, 0xd
call fcn.00caf2cc
mov eax, dword [ebp + edx - 0x6897eea6]
and dl, 0xb2
btc edx, 0x3f
shr edx, 0xe2
not ecx
dec ecx
lea ecx, [esp + edi*4 - 0xb6a69ec]
dec eax
bswap edi
bswap edx
dec eax
cwde
push edi
dec byte [esp + esi - 0xe837]
dec edx
not edx
shl cl, 0x63
inc esp
movzx esi, bh
inc sp
xadd dword [esp + esi*2 - 0x1d070], esi
bswap edx
ror dword [esp + eax + 0x2c59ff40], cl
inc eax
sub ch, byte [esp + esi - 0xe83b]
neg byte [esp + esi*8 - 0x741d7]
dec esp
mov dword [esp + esi*4 - 0x3a0ec], eax
dec eax
imul esi, ebp
inc ebp
movzx edi, si
call fcn.00c39e14
dec edi
pop ebx
or edx, ebp
sub dh, al
add dword [eax + eax*8 - 0xdd63ad6], edi
imul edx, dword [esi - 0x49fd1775], 0x12
mov esp, 0xc3333ccc
sal word [esp + ecx*2 - 0x19ff], 0x85
lea eax, [eax + ecx - 0x669dd49a]
rol eax, 3
mov edx, ecx
sub ecx, 0xc73f02b4
neg byte [esp + ecx*2 - 0x71821498]
dec eax
lea edx, [edx + edx*8 + 0xf83e6aa]
not eax
xor eax, 0x2a15e49c
xor cx, cx
bswap eax
sbb eax, 0xfa3b3038
and edx, 0xb891b06
xchg word [esp + ecx - 0x38c0ffff], dx
xor cl, 0x85
neg eax
xor ebx, eax
sar dl, cl
adc dl, 0x20
lea edx, [ecx + ecx + 0x2888860c]
add edi, eax
mov eax, edx
pop eax
jmp fcn.00d11dff
jmp 0xc8df40
Function at 0xc538b2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec edx
not dword [esp - 0x3d1961a6]
inc ecx
mov edx, dword [ebx + edx - 0x61b1]
movsx ebx, byte [esp + esi + 0x32ba7765]
dec edi
lea ebx, [ebx - 0x3d1961ad]
ja 0xc53883
xor cl, byte [edi - 0x73]
pushfd
and edx, dword [ebx - 0x62]
out 0xc2, al
xor bp, ax
inc ecx
xor edx, eax
inc edx
sub dword [esp - 0x7a32c34e], 0xea362098
dec eax
lea edi, [ecx*2 + 0x3991c798]
inc ebp
movzx esi, di
rol edx, 1
inc edx
xor edx, 0x5c25a909
xor bp, 0xfbb4
inc cx
sbb edi, 0xc2c1b822
add cl, byte [ecx + ecx*4 - 0x7c]
je 0xc538c7
out dx, al
je 0xc53975
inc di
cbw
setns cl
inc edx
xor dword [esp - 0x7a32c352], edx
inc ebp
movzx eax, si
dec eax
or ebx, 0x949d1f02
dec esp
mov eax, dword [esp + ebp*4 - 0x19400]
dec edx
and edi, dword [esp - 0x7a32c35a]
dec eax
arpl dx, dx
dec eax
mov dword [esp + esi + 0x32ba7765], 0xf6afc31f
inc edx
xadd byte [esp - 0x3d1961a4], al
inc dx
xchg dword [esp - 0x7a32c359], edi
dec esp
adc ebp, edx
dec esi
mov dword [esp - 0x3d1961b1], ebp
ret 0x10
dec ecx
sub al, 0xfd
cmp edx, edi
sbb dl, byte [ebx + 0xbc53ddb]
jmp 0xbd56d0fc

Function at 0xc6a591
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xe4ad1f02
sal edx, 8
xor eax, 0xca3b29b9
inc ecx
lea eax, [esp + eax - 0x59d18703]
push edx
shr word [esp + ebp*4 - 0x3a1b], cl
or bp, 0x30ac
rol eax, 2
imul edi, ebp
dec esp
mov dword [esp + ebp - 0x3eac], eax
dec ecx
shl esp, 0xc1
inc esp
cmovge edi, edx
inc eax
shr ch, 0x21
xor dword [esp + ebp - 0x3e56], eax
inc ebp
movzx ecx, di
inc eax
xor ch, 0xa5
add edx, edi
inc ecx
pop eax
dec eax
arpl ax, ax
dec esp
adc ebp, eax
jmp fcn.00d060e3
call fcn.00d1c555
dec ecx
mov eax, edx
dec ecx
sub edx, 2
inc ecx
mov esp, 0xa0010e88
inc ecx
movsx ebp, sp
movsx ecx, bp
inc cx
mov dword [edx + ebp - 0xe88], eax
mov ebx, 0x3f10cd88
movzx eax, bx
dec eax
xchg ecx, eax
inc ecx
mov eax, dword [ebx + ebp - 0xe88]
dec ebp
lea ebx, [ebx + ebp - 0xe84]
dec edx
lea edi, [0x8f140005]
mov esi, edi
inc ecx
xor eax, eax
inc esp
mov edi, ecx
mov edx, ebp
ror bx, 0xe1
rol eax, 2
sal edx, 0xb1
jp 0xc5f1aa
js 0xc6a639
cmp al, 0xd9
adc esp, ecx
sbb ecx, dword [eax + 0x3ccd2bca]
xchg byte [ecx - 0x72ffdbb4], cl
mov dword [esp], ecx
lea eax, [ecx - 0x1b526bef]
mov cx, word [edx]
mov word [ebp + 2], cx
lea ecx, [eax + eax*4 + 0x568e82b3]
mov edx, dword [esi - 4]
push eax
neg al
adc esi, 0xfffffffb
sal cx, 0x89
xor edx, ebx
sub ax, ax
pop eax
pop ecx
neg edx
sal eax, 0xbc
add cx, 0x860e
btc cx, ax
btc ecx, eax
bswap edx
push eax
xor cx, 0xa3b5
lea edx, [ecx + edx - 0x3f9d575]
push es
cld
push eax
jno 0x1482e62
not eax
seto dl
xor ebx, eax
call fcn.00ccfa57
ror edx, 0xfa
out 0xeb, al
or al, 0xeb
push ecx
add eax, 0xeb4c2168
dec ebp
add eax, 0xa7602168
xor dword [0x9bdc2168], eax
add eax, 0xfc216805
and dl, byte [edx - 0x457e4cb1]
inc edi
je 0xc6a649
insb byte es:[edi], dx
cmp byte [eax + eax*8 - 0x3930fe70], dh
retf 0x95cc
bswap ecx
not edx
push ecx
adc cl, 0x9b
xor ebx, edx
inc dword [esp + eax - 0x6ffffffc]
neg byte [esp + eax - 0x6ffffff5]
call fcn.00c84d97
Function at 0xc95107
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x1095430c
lea esp, [esp + 0x10]
je 0xce33c1
call int.00d29eea
Function at 0xcde797
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
xor eax, 0x3d0a37be
rol dx, cl
neg edx
bswap eax
shr edx, 0x24
or dl, byte [esp + edx - 0xffff0b4]
sbb eax, 0xc79bf922
dec dword [esp + edx*2 - 0x1fffe17c]
sete dl
neg edx
xor ebx, eax
mov dword [esp + 4], ecx
pop ecx
pop edx
add edi, eax
mov eax, 0x5406219d
btc ecx, edx
neg ax
jb fcn.00d11dff
mov esi, 0x3c8b94b5
call fcn.00c57415
inc ecx
mov esp, 0xa6109eb0
inc ecx
movzx eax, byte [ebx]
dec edx
lea edx, [0x5d86988c]
dec ecx
add ebx, 1
inc ecx
movsx ecx, sp
inc ecx
xor al, al
inc ecx
movsx ebx, ah
not al
dec al
xor al, 0xb8
dec eax
lea ebx, [edx + edx*2 + 0x924f09a]
neg al
inc ebp
movsx esi, ah
dec al
movzx ebp, bl
inc esp
xor al, al
dec eax
add eax, esp
inc esp
xchg bl, dh
rol cl, 0x43
movzx esi, cl
inc sp
mov esp, dword [eax + ebp*2 - 0xbc]
dec eax
shl ecx, cl
dec ecx
inc esi
dec ebp
lea edx, [edx + ebp - 0x60]
inc eax
jmp 0xcecf43
xor edx, 0x8a86110f
dec ecx
lea esp, [esp + 0x18]
jne 0xc5060e
mov eax, 0x1bb03c28
pop esi
not edx
mov eax, 0xeebe3f9f
mov dword [ebp], edx
movsx edx, ax
movsx ecx, dx
lea esi, [esi + edx - 0x3fa3]
sub dl, cl
bt cx, 0x23
mov ecx, dword [edx + esi - 0x3f00]
jae 0xc37712
mul eax
sub eax, eax
xor ecx, ebx
not dl
neg ecx
div dl
xor ecx, 0x34236791
neg al
or dx, 0x9a6
inc eax
lea ecx, [eax + ecx + 0x2aa4b531]
bswap eax
inc al
or dl, 0x90
not ecx
xchg al, dl
xor ebx, ecx
not dx
or edx, edx
adc edi, ecx
mov ecx, edx
jmp edi
jmp 0xce33aa

Function at 0xcebac6
Capabilities:
Encode data using xor

Disassembly:
inc edi
movzx esi, byte [ebx + ecx - 0x9a19]
dec edi
lea ebx, [ebx + ecx*8 - 0x4d0c7]
inc ebp
xor dh, al
dec edx
mov dword [esp + ecx - 0x9a19], edi
mov ebp, edi
inc ecx
dec dh
inc ecx
neg dh
dec esi
and dword [esp + ecx - 0x9a19], edi
setno cl
inc ecx
not dh
btr ebx, 0x19
inc ecx
sbb dh, 0x92
push esi
call int.00d0e425

Function at 0xcfec93
Capabilities:
Encode data using xor

Disassembly:
shr word [esp + ecx - 0x77df000], 0x82
adc eax, edx
mov edx, ecx
xor dword [esp + ecx - 0x77df000], ecx
xchg dword [esp + ecx - 0x77df000], edx
mov dword [ebp + ecx*2 - 0xefbdffc], eax
mov eax, ecx
bt cx, 0xa
mul dword [esp + ecx*2 - 0xefbe000]
mov edx, dword [esi + ecx - 0x77df004]
inc word [esp + ecx - 0x77defff]
shl cl, 0x62
lea esi, [ecx + esi - 0x77df004]
rol byte [esp + ecx - 0x77defff], 0x26
xor edx, ebx
mov dword [esp + ecx - 0x77df000], ecx
and eax, 0x96110992
ror al, 0xa2
lea edx, [edx + ecx*8 + 0x42bcc893]
sub byte [esp + ecx - 0x77defff], cl
or dword [esp + ecx*2 - 0xefbe000], 0x7a9d83b5
neg edx
inc edx
xor cx, cx
ror edx, 1
call fcn.00c70969
lea ebx, [ebx + edi*2 - 0x7c6e1aa4]
dec eax
add edx, 0x708033b1
neg ebx
inc ecx
sal esp, 0xcc
inc ecx
push eax
cdq
mov dword [esp + ecx*2 - 0xefbe000], ecx
mov edx, dword [ebp + ecx*2 - 0xefbdffc]
sal cl, 0x83
jae 0xc888b0
Function at 0xd22b72
Capabilities:
Encode data using xor

Disassembly:
dec cx
lea esi, [esi + ecx*2 - 0x20004]
xor dl, bl
mov eax, ecx
ror dword [esp + ecx*4 - 0x3fffc], cl
rol dl, 1
sub dl, cl
add eax, dword [esp + ecx - 0xffff]
inc eax
add eax, 0xca83dd3f
neg dl
rol eax, cl
sal cl, 0xc4
xor cl, ch
xor dl, 0xaa
pop ecx
add cl, ah
rol ax, 0xe5
xor bl, dl
add edx, esp
btr ecx, eax
jae 0x1419924
invalid
jmp edi
rol edx, 3
cwde
sub eax, 0x72be15b3
neg edx
cbw
neg cl
jne 0xd33c8a
call fcn.00c89c1b
mov edx, 0x46ac830f
lea eax, [edx + edx*8 + 0x7b3a819b]
movzx eax, byte [edx + esi - 0x46ac8310]
xor al, bl
lea ecx, [edx*8 - 0x6158b151]
not cl
sub al, 0x37
bt ecx, edx
ror al, 1
rol cl, 0xe1
xor al, 8
btc dx, cx
inc al
xadd cl, dh
bswap ecx
neg al
sub cl, ch
xor bl, al
dec cx
shl edx, cl
adc eax, esp
neg ecx
lea edx, [edx + ecx*4 + 0x34943501]
dec dx
mov ecx, dword [eax + edx - 0xfa912e0]
mov dword [ebp + edx*8 - 0x7d489704], ecx
sub dx, 0x240c
mov ecx, dword [edx + esi - 0xfa9eed9]
lea esi, [esi + edx*4 - 0x3ea7bb55]
xor ecx, ebx
movsx eax, dl
bswap ecx
sal edx, 0xfd
sbb al, al
dec ecx
neg dx
xor ecx, 0x8c15a297
inc al
not ecx
inc ecx
not ecx
sal al, 0x25
xor ebx, ecx
add edi, ecx
xor ax, 0xad19
mul al
movsx ecx, al
mov ecx, dword [ebp - 4]
jb 0xd4638b
dec edx
rol ecx, 0xe1
btr eax, ecx
neg edx
not eax
cbw
shr cl, cl
xor ebx, edx
add edi, edx
movzx edx, ax
sub cx, dx
jbe 0xc8235a
call fcn.00caa0a1
mov dword [esp + eax*2 - 0x79781e6e], eax
div byte [esp + eax - 0x3cbc0f35]
rol edx, 3
sub eax, 0x85074d22
adc word [esp + 1], ax
not edx
btr ax, ax
movzx ecx, ax
and al, 0x95
rol edx, 2
sal dword [esp + ecx*4 - 0xe7c8], cl
dec edx
shl ax, 0xa1
inc cx
xor ebx, edx
add edi, edx
xchg word [esp + ecx*4 - 0xe7cc], cx
bt eax, eax
sal ecx, 0x35
or cl, byte [ecx + esi - 5]
add eax, 0xf1bb943f
sal dword [esp], 0xf0
xor cl, bl
dec cl
neg cl
mov edx, dword [esp]
cdq
btc eax, eax
ror cl, 1
xor cl, 0x8c
xor bl, cl
lea ecx, [esp + ecx + 4]
shr eax, 0xff
mov dword [esp + eax], eax
jne 0xc9e0a8
or eax, dword [ecx + eax*8]
movzx ecx, word [esp]
and ecx, dword [esp + ecx]
shr dx, 0xaa
mov dword [ebp + ecx - 4], eax
sub dword [esp + ecx], ecx
movzx edx, byte [esi + ecx - 6]
jp 0xc5c378
mov eax, 0xbb3229aa
shl eax, 0x6e
movsx ecx, ax
mov edx, dword [ebp]
push eax
btr cx, 0xa6
push ecx
xor cl, byte [ebp + 4]
btc ax, ax
xchg dword [esp], eax
shr edx, cl
mov ecx, eax
bswap eax
push ecx
mov dword [ebp + eax*4 - 0x203fffa], edx
movzx edx, ax
pop eax
add dword [esp + edx - 0xfffe], ecx
lea edx, [ebp + edx*8 - 0x7fff6]
mov dword [ebp - 2], edx
sbb ecx, 0xfd1c0a33
call fcn.00cfb22e
ror eax, 1
shl dl, 0xa6
btc ecx, 0x30
inc eax
sar ecx, cl
btr cx, 0x99
adc cx, 0xe49d
xor ebx, eax
neg edx
add edi, eax
rol ecx, cl
movzx ax, byte [ebp + ecx - 0x72578000]
imul edx, edx
bts cx, cx
mov cl, byte [ebp + ecx - 0x72577fff]
bt dx, dx
adc ebp, 2
shl edx, 0x3d
shr al, cl
not dl
mov word [ebp + edx*2 - 0x1fe], ax
jmp edi
mov ax, word [ecx + edx - 0x6e]
lea ecx, [ecx*8 - 0xd4e0467]
mov word [ebp - 6], ax
lea eax, [ecx*2 - 0x53dd316e]
adc ebp, 0xfffffffa
jmp fcn.00d11dff
Function at 0x14101df
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esi]
mov eax, 0xff9da697
movsx edx, al
mov dword [esp], 0xb58db386
xor ecx, ebx
mov dword [esp + 4], eax
neg ecx
call fcn.0140bd3a
Function at 0x14886b5
Capabilities:
Encode data using xor

Disassembly:
inc esp
mov ecx, esi
inc ebp
xor edi, eax
imul al
inc ecx
not edi
cwd
inc ecx
ror edi, 2
inc ebp
lea edi, [edi + edx - 0x3b414538]
shl esi, 0x61
dec eax
not edx
inc sp
imul esp, edx
inc ecx
bswap edi
mov edi, eax
not edi
inc ecx
dec edi
inc ecx
push eax
bts si, 0x33
jae 0xd2dfd6
inc dx
and dword [esp + esi - 0xcc], ebx
jns 0xd24974
aas
pop esp
push es
lea ecx, [ebx - 0x5e]
add eax, 0x8103f987
mov dh, 9
cmpsd dword [esi], dword es:[edi]
stc
add eax, dword [ecx - 0x66cd642]
xchg ebx, eax
stc
add eax, dword [ecx - 0x678de8a]
add eax, dword [ecx + 0x246ebc6a]
adc edx, dword [esi + 0x641fbb4c]
jg 0xca5219
pop ds
inc edi
xchg edx, eax
dec ebp
xlatb
xor eax, 0x92993868
push eax
aam 0xc6
adc eax, 0xd0cd92e2
out 0x2e, al
adc ch, byte [ebp - 0x4f]
in al, 0xde
adc ch, byte cs:[ebp - 0x1f]
invalid
jmp 0xca51c7
inc ebp
xor ecx, eax
inc ecx
push edi
shl bp, 8
inc ecx
ror ecx, 1
inc ecx
movzx ecx, dh
dec eax
lea edi, [esi + esi + 0x26002abf]
inc ecx
sub ecx, 0x8db7dd14
inc cx
dec esi
inc cx
inc ecx
not ecx
inc edx
xchg dword [esp + esi*2 - 0x182], edi
pop edx
inc esp
sub ecx, edi
inc esi
movsx esp, byte [esp + esi*2 - 0x18a]
inc dx
sar dword [esp + esi*2 - 0x188], cl
inc edx
inc byte [esp + esi - 0xc5]
dec esi
mov dword [esp + esi*2 - 0x18e], eax
inc esi
xor dword [esp + esi - 0xc3], ecx
dec esi
mov eax, dword [esp + esi*2 - 0x18e]
dec eax
lea eax, [edx*2 - 0x4df7995c]
dec ebp
arpl cx, cx
dec ebp
add ebp, ecx
dec esi
mov dword [esp + esi*4 - 0x32c], ebp
ret 8
dec ecx
mov ebp, dword [edx + esi*2 - 0x1b06a96c]
movzx edx, si
shr si, 0xd
inc esp
mov esp, esi
inc edx
mov ebx, dword [esi + edx - 0xd82fffa]
inc ecx
cmovb edx, esp
mov dword [ebp + esi*2 - 0x1b060004], ebx
dec ecx
lea eax, [esp + esi*4 - 0x5e542949]
inc eax
sub dh, dh
inc ecx
inc ah
inc ebp
mov edi, dword [ebx + esi*2 - 0x1b060000]
jne 0xc4faed
call fcn.01478e20
inc ecx
or esi, edi
dec eax
lea eax, [esp + eax + 0x10]
dec esi
mov dword [esp + ecx - 0x34], edi
dec edx
and dword [esp + ecx - 0x2c], 0xd6377689
dec edx
mov dword [eax + ecx*2 - 0x68], edi
inc edi
mov ecx, dword [ebx + ecx - 0x33]
dec edi
lea ebx, [ebx + esi*2 - 0x193]
jl 0xca51a5
mov esi, 0xd8354b6
jmp 0xd52f4b
Function at 0x40a700
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40a8ce
sub esp, 0x38
mov eax, dword [esp + 0x3c]
cmp eax, 0x7000000
jle 0x40a72b
mov eax, 0x7000000
jmp 0x40a733
test eax, eax
je 0x40a8a9
mov dword [esp + 0x14], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
shr ecx, 6
inc ecx
mov dword [esp], ecx
call fcn.00451fd0
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x2c]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, 0
adc esi, 0
shl ebx, 5
mov edi, dword [esp + 0x28]
shr edi, 0x1b
or edi, ebx
lea ebx, [0x69c120]
movsd xmm0, qword [ebx + ebp*8]
test esi, esi
jne 0x40a8c1
cmp ecx, 0x21
jae 0x40a8b5
movsd qword [esp + 0x18], xmm0
mov dword [esp + 0x10], edi
add edx, 0xfffffc01
mov edx, 0xffffffff
adc edx, 0
movsd xmm0, qword [ebx + ecx*8]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044d070
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x30], xmm0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x10]
and eax, 0xfffff
mov dword [esp], eax
call fcn.0044d140
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x18]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x20]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm1, xmm2
movsd xmm2, qword [0x5f94e4]
mulsd xmm2, xmm1
addsd xmm0, xmm2
movsd xmm1, qword [0x5f959c]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40a884
xorps xmm0, xmm0
mov eax, dword [esp + 0x14]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x5f95fc]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x40], eax
add esp, 0x38
ret
mov dword [esp + 0x40], 0
add esp, 0x38
ret
mov eax, ecx
mov ecx, 0x21
call fcn.004520b0
mov eax, ecx
mov ecx, 0x21
call fcn.00452170
nop
call fcn.00450c10
jmp fcn.0040a700
Function at 0x411c70
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x411e94
sub esp, 0x18
mov eax, dword [0x6d60f8]
test eax, eax
jne 0x411e7d
nop
lea eax, [0x6d60e4]
mov dword [esp], eax
call fcn.00408810
mov eax, dword [0x6d60e8]
test eax, eax
je 0x411cb9
cmp dword [eax + 8], 0xcc
jne 0x411d2f
mov edx, dword [0x6d60dc]
test edx, edx
jne 0x411d11
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x6d9530]
mov dword [esp + 8], eax
call fcn.0040a8e0
mov eax, dword [esp + 0xc]
mov dword [0x6d60dc], eax
mov ecx, dword [0x6d60a0]
mov dword [eax], ecx
mov eax, dword [0x6d60dc]
mov dword [0x6d60a0], eax
movzx eax, byte [0x6d67a0]
test al, al
jne 0x411d11
xor eax, eax
jmp 0x411e29
mov edx, dword [0x6d60dc]
mov ebx, dword [edx + 4]
mov dword [0x6d60dc], ebx
mov ebx, dword [0x6d60e8]
mov dword [edx + 4], ebx
mov dword [0x6d60e8], edx
mov edx, dword [0x6d60e8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x411e11
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.004020d0
mov eax, dword [esp + 0x10]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x14]
lea edi, [ecx + eax*4 + 0x10]
mov edx, dword [0x6d6280]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x411d8d
mov edx, dword [esp + 0x20]
mov dword [ecx + eax*4 + 0x10], edx
jmp 0x411d9a
mov edx, eax
mov eax, dword [esp + 0x20]
call fcn.00452020
mov eax, edx
mov edx, dword [esp + 0x24]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x6d6280]
test edx, edx
jne 0x411dc6
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + eax*4 + 0x14], edx
jmp 0x411de7
mov edi, ebx
mov eax, dword [esp + 0x28]
call fcn.00452020
mov edi, ebp
mov eax, dword [esp + 0x2c]
call fcn.00452020
mov edi, esi
mov eax, dword [esp + 0x1c]
call fcn.00452020
nop
lea eax, [0x6d60e4]
mov dword [esp], eax
call fcn.00408a10
nop
lea eax, [0x6d60e0]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402250
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.004520b0
lea esi, [0x6d67a0]
xchg ebp, eax
mov byte [esi + ebx], al
xchg ebp, eax
lea eax, [ebx + 1]
cmp eax, 0x80
jge 0x411d11
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov eax, ecx
sar ecx, 0x1f
sub edx, ecx
lea edx, [edx + edx*4]
mov ebx, eax
sub eax, edx
cmp eax, 5
jae 0x411e73
lea edx, [0x697148]
movzx ebp, byte [edx + eax]
cmp ebx, 0x80
jb 0x411e1b
mov eax, ebx
mov ecx, pe_nt_image_headers32
call fcn.004520a0
mov ecx, 5
call fcn.004520a0
lea eax, [0x5d1562]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.0042ee20
nop
call fcn.00450c10
jmp fcn.00411c70
Function at 0x419a30
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x419c5e
sub esp, 0x20
mov eax, dword [esp + 0x24]
test eax, 3
jne 0x419c47
mov edx, dword [esp + 0x30]
mov ebx, dword [edx + 0x2c]
test byte [ebx], al
nop
movzx ebp, byte [0x6d606e]
mov ecx, dword [esp + 0x38]
mov esi, ecx
shr ecx, 3
mov dword [esp + 0x1c], ecx
mov edi, esi
and esi, 7
mov ecx, esi
mov eax, 1
shl eax, cl
mov esi, dword [esp + 0x1c]
mov ecx, eax
lea eax, [ebx + esi]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x419b58
mov ebp, dword [0x6d660c]
test ebp, ebp
jle 0x419abc
cmp dword [edx + 0x58], edi
ja 0x419abc
mov ebp, dword [edx + 0x28]
test byte [ebp], al
movzx ebp, byte [ebp + esi]
nop
xchg ebp, eax
test cl, al
xchg ebp, eax
je 0x419bce
movzx ebx, byte [esi + ebx]
test cl, bl
jne 0x419b54
nop
mov dword [esp], eax
mov byte [esp + 4], cl
call fcn.00402220
mov eax, dword [0x6b619c]
test byte [eax], al
nop
nop
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0xc]
nop
mov ebx, edx
shr edx, 0x16
mov edx, dword [eax + edx*4]
test byte [edx], al
mov ebp, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx esi, byte [edx + ebx + 0x21840]
lea edx, [edx + ebx + 0x21840]
shr ebp, 0xd
and ebp, 7
mov eax, ecx
mov ecx, ebp
mov ebx, 1
shl ebx, cl
xchg esi, eax
test bl, al
xchg esi, eax
jne 0x419b2f
mov dword [esp], edx
mov byte [esp + 4], bl
call fcn.00402220
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + 0x3a]
test dl, 1
je 0x419b89
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebx, 0
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], ebx
add esp, 0x20
ret
add esp, 0x20
ret
mov edx, dword [esp + 0x24]
mov dword [esp], edx
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], cl
mov dword [esp + 0x14], edi
call fcn.00411600
movzx eax, byte [esp + 0x18]
test al, al
jne 0x419bc0
mov edx, dword [esp + 0x34]
mov ebx, dword [edx]
test ebx, ebx
je 0x419bac
mov eax, dword [ebx + 0xc]
cmp eax, 0x1fc
je 0x419bac
jae 0x419bc4
mov ecx, dword [esp + 0x24]
mov dword [ebx + eax*4 + 0x10], ecx
inc dword [ebx + 0xc]
jmp 0x419bbc
mov dword [esp], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.0041fe70
add esp, 0x20
ret
add esp, 0x20
ret
mov ecx, 0x1fc
call fcn.004520a0
lea eax, [0x5ce008]
mov dword [esp], eax
mov dword [esp + 4], 4
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
call fcn.00419c70
lea eax, [0x5cdf46]
mov dword [esp], eax
mov dword [esp + 4], 3
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
call fcn.00419c70
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov byte [eax + 0x9d], 2
lea eax, [0x5cff60]
mov dword [esp], eax
mov dword [esp + 4], 0x13
call fcn.0042ee20
lea eax, [0x5d3ac8]
mov dword [esp], eax
mov dword [esp + 4], 0x23
call fcn.0042ee20
nop
call fcn.00450c10
jmp fcn.00419a30