joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cd0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov dword [ebp - 4], 0x3a98
mov eax, dword [ebp - 4]
push eax
push 0
mov dword [esi + 0x24], 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x24], eax
test eax, eax
je 0x405d29
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 6
push 2
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp edi, 0x6f
jne 0x405d45
mov edx, dword [esi + 0x24]
push edx
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x405ce3
mov eax, dword [esi + 0x1c]
push str.htc::IPTNetworkHelper::NetworkHelper::CreateAdapterAddressesHeapByDescription
push str.__s__Error__Memory_allocation_failed_for_IP_ADAPTER_ADDRESS_struct.
call eax
add esp, 8
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
test edi, edi
jne 0x405da0
mov edi, dword [esi + 0x24]
test edi, edi
je 0x405e1c
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x24]
push ecx
push eax
call fcn.0040d64c
add esp, 8
test eax, eax
jne 0x405d74
invalid

Function at 0x405e40
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x405e73
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x405e5a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x405e6b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x405e75
inc edi
add eax, 0x28
cmp edi, esi
jb 0x405e50
xor eax, eax
pop edi
pop esi
ret

Function at 0x4060f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405df8
mov edx, 0x8d40669e
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40c2df
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4262ac]
jne 0x40c2e9
repz ret
jmp fcn.00410ef2

Function at 0x41526e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x415295
call fcn.0040ed40
mov dword [eax], esi
call fcn.0040ed2d
push 0x16
pop esi
mov dword [eax], esi
call fcn.00411304
mov eax, esi
jmp 0x4152ea
test dword [ebp + 0xc], 0xfffffff9
jne 0x41527b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4152c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040ed53
pop ecx
call fcn.0040ed2d
mov eax, dword [eax]
jmp 0x4152ea
test al, 0x10
jne 0x4152e8
test al, 1
je 0x4152e8
test byte [ebp + 0xc], 2
je 0x4152e8
call fcn.0040ed40
mov dword [eax], 5
call fcn.0040ed2d
mov dword [eax], 0xd
jmp 0x4152b9
xor eax, eax
pop esi
pop ebp
ret
Function at 0x41a95c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4262ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00414781
and dword [ebp - 0x14], 0
cmp dword [0x428164], 0
mov dword [ebp - 0x18], eax
jne 0x41aa0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41aab7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41aab7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x428164], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x428168], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42816c], eax
call edi
push eax
call esi
mov dword [0x428174], eax
test eax, eax
je 0x41aa0f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x428170], eax
mov eax, dword [0x428170]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41aa68
cmp dword [0x428174], ecx
je 0x41aa68
push eax
call esi
push dword [0x428174]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41aa68
test ebx, ebx
je 0x41aa68
call edi
test eax, eax
je 0x41aa5f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41aa5f
test byte [ebp - 8], 1
jne 0x41aa68
or dword [ebp + 0x10], 0x200000
jmp 0x41aa9b
mov eax, dword [0x428168]
cmp eax, dword [ebp - 0x18]
je 0x41aa9b
push eax
call esi
test eax, eax
je 0x41aa9b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41aa9b
mov eax, dword [0x42816c]
cmp eax, dword [ebp - 0x18]
je 0x41aa9b
push eax
call esi
test eax, eax
je 0x41aa9b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x428164]
call esi
test eax, eax
je 0x41aab7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41aab9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c2df
leave
ret
Function at 0x404d7a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x70]
push 0x44
push esi
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x18], esi
call fcn.0042f600
xor eax, eax
mov dword [ebp - 0x14], esi
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
add esp, 0xc
mov ebx, esi
mov dword [ebp - 4], ebx
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004034c4
mov esi, eax
test esi, esi
jns 0x404dd6
push str.Failed_to_get_path_for_current_process.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x404f72
call fcn.004197d7
mov ebx, dword [ebp + 0xc]
test eax, eax
je 0x404de9
mov eax, dword [ebp - 0xc]
mov edi, eax
jmp 0x404e1e
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebx + 0x48]
push eax
lea eax, [ebx + 0xbc]
push eax
call fcn.004197dd
mov esi, eax
test esi, esi
jns 0x404e18
push str.Failed_to_cache_to_clean_room.
push esi
call fcn.0043fb09
mov ebx, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x404f72
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
push eax
push str.burn.clean.room
lea eax, [ebp - 8]
push str.__ls__ls_
push eax
call fcn.00402022
mov esi, eax
add esp, 0x10
test esi, esi
jns 0x404e42
push str.Failed_to_allocate_parameters_for_unelevated_process.
jmp 0x404e08
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x48]
call fcn.00416955
mov esi, eax
test esi, esi
jns 0x404e70
push str.burn.filehandle.attached
push str.Failed_to_append__ls
push esi
call fcn.0043fb09
mov ebx, dword [ebp - 4]
jmp 0x404f6f
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.00416a0f
mov esi, eax
test esi, esi
jns 0x404e8d
push str.burn.filehandle.self
jmp 0x404e5d
push dword [ebp + 8]
lea eax, [ebp - 8]
push dword [ebp - 8]
push 0x44acd4
push eax
invalid
Function at 0x4051d2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0x18]
push 0x11c
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x120]
push ebx
push eax
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
call fcn.0042f600
push 0x4e8
lea eax, [ebp - 0x630]
mov dword [ebp - 0x124], ebx
push ebx
push eax
mov dword [ebp - 0x130], ebx
call fcn.0042f600
add esp, 0x18
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0043fdc4
push ebx
push 3
call fcn.0043ff78
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
push eax
push esi
call fcn.00401206
mov esi, eax
test esi, esi
jns 0x405296
push str.Failed_to_parse_command_line.
push esi
call fcn.0043fb09
pop ecx
pop ecx
mov edi, ebx
jmp 0x405511
push edi
lea eax, [ebp - 0x630]
push eax
call fcn.00404326
mov esi, eax
test esi, esi
jns 0x4052b0
push str.Failed_to_initialize_engine_state.
jmp 0x405287
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x604], eax
call fcn.00405653
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
jns 0x4052d5
push str.Failed_to_initialize_COM.
jmp 0x405287
xor edi, edi
inc edi
call fcn.0043f58a
mov esi, eax
test esi, esi
jns 0x4052f5
push str.Failed_to_initialize_Cryputil.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x405511
mov dword [ebp - 0x144], edi
call fcn.004406c0
mov esi, eax
test esi, esi
jns 0x40530d
push str.Failed_to_initialize_Regutil.
jmp 0x4052e8
mov dword [ebp - 0x140], edi
call fcn.00442368
mov esi, eax
test esi, esi
jns 0x405325
push str.Failed_to_initialize_Wiutil.
invalid

Function at 0x409a9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409aca
push str.Failed_to_format_variable_string.
jmp 0x409b44
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409b05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409aef
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409aff
cmp esi, 0x80070003
jne 0x409b01
xor esi, esi
xor eax, eax
jmp 0x409b0f
xor eax, eax
xor ecx, ecx
test dl, 0x10
je 0x409b11
inc eax
xor ecx, ecx
test esi, esi
jns 0x409b2a
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409b4c
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x409b4c
push str.Failed_to_set_variable.
push esi
call fcn.0043fb09
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x409b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409b92
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x409c1d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409bb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409bdd
movzx esi, si
or esi, 0x80070000
jmp 0x409bdd
test al, 0x10
je 0x409bd8
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821a
mov esi, eax
test esi, esi
jns 0x409bdd
push str.Failed_to_set_directory_search_path_variable.
jmp 0x409b85
mov esi, 0x80070003
cmp esi, 0x80070002
je 0x409c06
cmp esi, 0x80070003
je 0x409c06
test esi, esi
jns 0x409c1d
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_directory_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409c1d
push esi
push dword [ebp - 4]
push dword [edi]
push str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
push 2
call fcn.0043fff0
add esp, 0x14
xor esi, esi
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x409c2d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409c5b
push str.Failed_to_format_variable_string.
jmp 0x409cf9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
jne 0x409cd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 2
je 0x409cb8
cmp esi, 3
je 0x409cb8
test esi, esi
je 0x409ccc
jle 0x409c8e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x409c95
mov esi, 0x80004005
push esi
push 0x28b
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
push dword [edi + 0x14]
push str.Failed_get_to_file_attributes.__ls
push esi
call fcn.0043fb09
add esp, 0xc
jmp 0x409d01
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043fff0
add esp, 0x10
xor eax, eax
jmp 0x409cdd
xor eax, eax
xor ecx, ecx
test edx, 0x10
jne 0x409cdf
inc eax
xor ecx, ecx
push 0
push ecx
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408274
mov esi, eax
test esi, esi
jns 0x409d01
push str.Failed_to_set_variable.
push esi
call fcn.0043fb09
pop ecx
pop ecx
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x409d11
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push eax
push dword [edi + 0x14]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x409d47
push str.Failed_to_format_variable_string.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x409dca
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409d93
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x409d6a
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x409db4
cmp esi, 0x80070003
je 0x409db4
test esi, esi
jns 0x409dca
push dword [ebp - 4]
push dword [edi]
push str.Failed_while_searching_file_search:__ls__for_path:__ls
push esi
call fcn.0043fb09
add esp, 0x10
jmp 0x409dca
test al, 0x10
jne 0x409db4
push 0
push dword [ebp - 4]
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040821a
mov esi, eax
test esi, esi
jns 0x409d6a
push str.Failed_to_set_variable_to_file_search_path.
jmp 0x409d3a
push dword [ebp - 4]
push dword [edi]
push str.File_search:__ls__did_not_find_path:__ls
push 2
call fcn.0043fff0
add esp, 0x10
xor esi, esi
push dword [ebp - 4]
call fcn.0040287d
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x4390bc
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
pushal
mov eax, dword [0xc0850044]
mov dword [0x46b578], eax
setne al
ret
inc esi
add byte [eax], al
mov al, 1
ret
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x46a008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
jne 0x439056
mov al, 1
jmp 0x4390ad
push esi
mov esi, edi
push ebx
mov ebx, dword [esi]
test ebx, ebx
je 0x43906e
mov ecx, ebx
call dword [0x44a3e0]
call ebx
test al, al
je 0x439076
neg eax
dec ecx
mov ecx, edi
or esi, edi
xor edx, eax
call fcn.0042e3af
xor eax, 0x13ab27c8
add ecx, eax
dec eax
test eax, ebp
shr al, 1
xor edx, dword [ebx - 1]
inc dword [ecx - 0x54d83710]
adc eax, dword [ebx]
enter 0xffffffffffff8548, 0xffffffffffffffe8
jo 0x439020
or esi, edi
xor esi, 0x167e3b4
xchg eax, eax
mov ecx, 0x1d54c82e
xchg eax, eax
inc eax
rol eax, 2
xchg eax, eax
neg edx
rol eax, 0x15
shl eax, 0x1e
xchg eax, esi
test eax, 0x1d33b4e2
jo 0x439033
mov ah, 0x33
sbb eax, 0xb408170
adc eax, 0x46a140
inc eax
or edx, dword [0x46a140]
loop 0x439098
test ecx, edx
jo 0x4390c3
mov esi, ebp
rol eax, 0xb
xor edi, esp
ror byte [ebx], 0x33
or esi, dword [ebx]
cld
rol esi, 0x12
sub eax, 0x3d282fe
xor ecx, esp
or esi, 0x7c4ef15
inc eax
mov esi, eax
ror esi, 0xc
not eax
xor edi, ebp
rol ecx, 8
neg eax
mov ecx, dword [0x46a0f4]
or esi, edi
sub edi, ebp
test esp, esp
jb 0x4390c2
neg edx
call fcn.0042dde0
shr edx, 3
mov edi, eax
call fcn.00413e16
rol eax, 0x19
test esp, edi
jo 0x4390c2
inc eax
call fcn.0042e514
test eax, 0x15dcc6b6
jo 0x43911c
inc esi
or esi, edi
call fcn.0042dde0
ror esi, 0x1c
mov ecx, 0xf843500
invalid
neg esi
shr edx, 0x15
neg edx
or dword [0x46a041], ecx
inc eax
dec edx
inc eax
shr esi, 0xd
rol eax, 0x11
dec esi
rol esi, 9
or dword [0x46a3d5], esi
loop 0x43912a
ror edx, 0x13
inc eax
mov esi, eax
ror eax, 0x11
add esi, ebp
xor esi, eax
xor esi, 0x534af20
or esi, edi
shr esi, 0x18
not ebx
add edi, eax
xor eax, 0x6fdeec8
mov ecx, 0x19b42d8
fadd dword [edx - 0x65]
add ecx, eax
jmp 0x439194
shr ebx, 0x1e
ror esi, 0x1e
mov dword [0x46a672], 0x1969a808
inc eax
mov esi, dword [0x46a895]
test esp, ebp
jo 0x43916f
not esi
inc eax
shr edx, 5
loop 0x439173
sub eax, esp
not edi
shr ebx, 0xc
sub esi, eax
and esi, edi
and ecx, dword [0x46a5bb]
xor edi, edx
mov edi, esp
and esi, edi
call fcn.0042dde0
ror edi, 3
inc eax
call fcn.00401205
or esi, edi
sub edi, dword [0x46a172]
neg esi
not esi
mov edx, esp
sub esi, edi
mov esi, eax
dec eax
sub eax, ebp
not ecx
mov esi, eax
not eax
push str.KERNEL32.dll
inc esi
add ecx, dword [0x46a4b4]
call fcn.0042e514
rol esi, 0x12
xor esi, esp
dec esi
xor edx, dword [0x46a746]
xchg ecx, eax
Function at 0x4391f5
Capabilities:
Hash data using murmur3

Disassembly:
rol eax, 0x12
add eax, 0x28eb47c2
mov dword [0x46baf7], 0x2975acc3
sub edx, dword [0x46a6fe]
inc esi
add byte [ebx], al
fisttp qword [ecx + 0x46b72e1d]
add byte [ecx + 0x31], al
sbb eax, 0x46b827
or dword [0x46b9d6], 0x2c12ff21
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esi, eax
xor ecx, dword [0x46be7e]
xor esi, eax
add ecx, esp
dec edx
xor ebx, dword [0x46bef0]
ror esi, 0x15
xor ecx, esp
add ecx, 0xb87be27
xor edx, esi
ror edi, 4

Function at 0x43920c
Capabilities:
Hash data using murmur3

Disassembly:
inc esi
add byte [ebx], al
fisttp qword [ecx + 0x46b72e1d]
add byte [ecx + 0x31], al
sbb eax, 0x46b827
Function at 0x439250
Capabilities:
Hash data using murmur3

Disassembly:
inc eax
xor eax, 0xc9f5112
mov dword [0x46ba28], 0x14a0814
xor edi, dword [0x46bf75]
add edx, edi
sub edx, edi
xor eax, 0xc9f5112
dec eax
rol edi, 4
xor edx, esi
sub ecx, 0xb87be27
xor ecx, esp
rol esi, 0x15
inc edx
sub ecx, esp
xor esi, eax
add esi, eax
push 0
dec esi
mov dword [0x46b92a], 0x280b8822
not eax
ror esi, 0xb
not ecx
sub dword [0x46b801], edx
xor esi, eax
sub esi, 0x1cd83370
xchg eax, eax
xor edi, dword [0x46be24]
neg edx
add dword [0x46ba8e], ecx
add edx, dword [0x46bdce]
and dword [0x46b9de], ecx
xchg esi, eax
neg esi
sub ecx, dword [0x46bbbc]
rol esi, 0x10
sub esi, 0x235de3c5
mov dword [0x46b892], edi
call fcn.004047de
dec eax
inc eax
call fcn.00406bf3
sub dword [0x46b81e], edi
add esi, 0x235de3c5
ror esi, 0x10
neg esi
xchg esi, eax
mov dword [0x46b9b3], ecx
neg edx
xchg eax, eax
add esi, 0x1cd83370
xor esi, eax
not ecx
rol esi, 0xb
not eax
mov dword [0x46b73e], 0x1d74c342
inc esi
push 0x636f6c6c
call fcn.00406bf3
xchg eax, edx
xor eax, ecx
or dword [0x46bac2], 0x11e1c72a
sub edx, edi
rol edi, 0x18
xor esi, dword [0x46bf34]
xchg eax, edx
add esi, eax
sub edi, ecx
call fcn.00406278
sub edx, dword [0x46beb4]
xor ecx, dword [0x46bbca]
sub edi, edx
xchg esi, esi
call fcn.00404270
ror edx, 0x12
xchg ebx, edx
xor edi, dword [0x46bd5f]
xchg esi, edx
xchg esi, edx
xchg ebx, edx
rol edx, 0x12
call fcn.00403b1b
xchg esi, esi
add edi, edx
call fcn.00405324
add edi, ecx
sub esi, eax
xchg eax, edx
ror edi, 0x18
add edx, edi
xor eax, ecx
xchg eax, edx
call fcn.00407f79
push 0x416c6175
ror esi, 4
xor eax, ecx
xor ebx, dword [0x46bdb0]
neg esi
mov dword [0x46b7a6], edx
add esi, dword [0x46bbee]
rol eax, 0xd
mov dword [0x46b76a], ecx
xor esi, 0xe402b14
ror esi, 0xc
rol esi, 0xc
xor esi, 0xe402b14
ror eax, 0xd
add dword [0x46ba13], ecx
neg esi
xor eax, ecx
rol esi, 4
push 0x74726956
xchg eax, esi
sub ecx, dword [0x46bf1f]
neg esi
sub edi, ecx
add eax, ebp
xchg esi, eax
add ecx, dword [0x46bcd9]
sub esi, 0xa57257c
not edx
xor eax, 0x20be838
sub esi, dword [0x46bea0]
rol esi, 0x1b
inc eax
xor esi, 0x222978
sub ecx, dword [0x46bfa8]
xchg eax, esi
call fcn.00401205
call fcn.00401205
xchg eax, esi
xor esi, 0x222978
dec eax
ror esi, 0x1b
xor eax, 0x20be838
not edx
add esi, 0xa57257c
xchg esi, eax
sub eax, ebp
add edi, ecx
neg esi
xchg eax, esi
push esp
mov dword [0x46b944], edx
xor esi, ebp
add esi, edi
rol edx, 0x18
mov dword [0x46bb6c], 0xfbae358
inc esi
ror esi, 0x1f
xor edi, 0x7216540
rol eax, 0x18
sub esi, 0x2ae42b33
xor ebx, dword [0x46bcd4]
not ebx
dec edi
xor ecx, dword [0x46bed7]
inc edi
not ebx
add esi, 0x2ae42b33
ror eax, 0x18
xor edi, 0x7216540
rol esi, 0x1f
dec esi
ror edx, 0x18
sub esi, edi
xor esi, ebp
and dword [0x46baa4], esi
push eax
xor esi, 0x52aff79
rol esi, 0x16
xor dword [0x46b9f6], 0x3a080c35
sub dword [0x46b9b8], ecx
sub edi, ebx
mov dword [0x46b754], ebx
xor ecx, edx
or dword [0x46b824], ebx
xor esi, 0x6d06500
mov dword [0x46bb14], 0x206b7340
sub eax, 0x1cf6a88
rol esi, 0xf
xchg esi, eax
not esi
add esi, eax
call fcn.00404ae9
sub esi, eax
not esi
Function at 0x490cb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x490cc5
pop dword [ebp - 0x50]
mov eax, 0x6dcc8beb
sub eax, 0x6d837f26
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xfdb2ed74
add dword [ebp - 0x60], 0x509f57d7
mov dword [ebp - 0x5c], 0x6782aa5e
sub dword [ebp - 0x5c], 0x354f5e19
mov dword [ebp - 0x58], 0xd4a1187f
sub dword [ebp - 0x58], 0x8854d451
mov dword [ebp - 0x54], 0xb0ec257
add dword [ebp - 0x54], 0xf4f13da9
lea eax, [ebp - 0x60]
push eax
mov eax, 0x8cd96266
sub eax, 0x8c8fd212
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x63a05bfb
sub dword [ebp - 0x60], 0xef2df2a5
mov dword [ebp - 0x5c], 0xc73f69e0
sub dword [ebp - 0x5c], 0x85d3086b
mov dword [ebp - 0x58], 0xe85eaf7b
sub dword [ebp - 0x58], 0x84ef430f
mov dword [ebp - 0x54], 0x5b7c0323
add dword [ebp - 0x54], 0xa483fcdd
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x688c6
push 0
call eax
mov ecx, 0x75ffc96e
sub ecx, 0x75ff9a01
xor ebx, ebx
add ebx, eax
mov edi, 0x4a85e9f0
add edi, 0xb5c67410
add edi, dword [ebp - 0x50]
mov edx, 0xe7f51de8
xor dword [ebp - 0x34], 0x9d08471f
mov esi, dword [edi]
add dword [ebp - 0x1c], 0xe9648d84
add esi, edx
add dword [ebp - 8], edx
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x57fe60d0
add ebx, 0xa855c88e
add ebx, 0x57aa3776
add edi, 0x598ca71d
add edi, 0xa67358e7
loop 0x490dde
add eax, 0xb087
mov ebx, eax
add eax, 0x6c9951ac
add eax, 0x9366ae59
mov ecx, 0x8b51d974
sub ecx, 0x8b11d974
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x401530
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], str.sbiedll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401557
mov eax, 1
jmp 0x40155c
mov eax, 0
leave
ret

Function at 0x40155e
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x50], 0x40
lea eax, [ebp - 0x50]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call eax
sub esp, 4
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov edx, 0x3fffffff
mov eax, 0
cmp edx, dword [ebp - 0x10]
sbb eax, dword [ebp - 0xc]
jb 0x4015a0
mov eax, 0
jmp 0x4015a5
mov eax, 1
leave
ret