joyce8/EMBER2024-capa huggingface dataset:
Function at 0x528dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x528df8
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x528e00
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x528de4
test esi, esi
je case.0x528ec0.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x528e47
cmp esi, 1
jbe case.0x528ec0.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x528e47
cmp esi, 2
jbe case.0x528ec0.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x528e47
cmp esi, 3
jbe case.0x528ec0.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x528ec0.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x528e70
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x528e70
inc edx
inc eax
cmp edx, edi
jl 0x528e63
lea eax, [edi - 1]
test eax, eax
jl 0x528e91
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x528e91
cmp byte [ecx], 0xff
jne 0x528e91
dec eax
dec ecx
test eax, eax
jge 0x528e80
cmp edx, eax
jl case.0x528ec0.2
jle 0x528ea2
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x528ec0.2
movzx ecx, byte [ecx + 0x528f30]
jmp dword [ecx*4 + 0x528f10]
mov esi, 7
jmp 0x528ef6
mov esi, 6
jmp 0x528ef6
mov esi, 5
jmp 0x528ef6
mov esi, 4
jmp 0x528ef6
mov esi, 3
jmp 0x528ef6
mov esi, 2
jmp 0x528ef6
mov esi, 1
test byte [esp + 0x10], al
jne case.0x528ec0.2
and bl, al
cmp bl, al
jne case.0x528ec0.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x536980
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x536992
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push esi
push eax
call fcn.00467600
mov esi, eax
add esp, 4
test esi, esi
jge 0x5369a9
pop esi
xor eax, eax
pop edi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5369b3
mov dword [eax], esi
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x536a41
mov eax, dword [edi + 0x84]
push ebp
cmp eax, esi
jne 0x5369e6
test esi, esi
jle 0x536a1e
mov ecx, ebx
lea eax, [edi + 4]
mov ebp, esi
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x5369d6
jmp 0x536a1e
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0x64], 0x80
jle 0x536a05
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.0055bfc0
add esp, 0xc
test esi, esi
jle 0x536a1e
mov ecx, ebx
lea eax, [edi + 0x24]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x536a10
mov eax, dword [edi]
push esi
push ebx
push ebx
push eax
call fcn.00467610
add esp, 0x10
pop ebp
test eax, eax
jne 0x536a41
push esi
push ebx
call fcn.0046b340
add esp, 8
pop ebx
pop esi
xor eax, eax
pop edi
ret
pop ebx
pop esi
mov eax, 1
pop edi
ret
Function at 0x53cc00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0055bc20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ebp
mov ebp, ecx
shr ebp, 3
mov dword [esp + 4], ebp
cmp eax, ecx
jb 0x53ccf7
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x18]
push edi
nop
xor edi, edi
test ebp, ebp
jbe 0x53ccd9
lea ebx, [ebx]
movzx eax, byte [esi + 7]
cdq
shld edx, eax, 8
shl eax, 8
mov ecx, eax
movzx eax, byte [esi + 6]
mov ebp, edx
cdq
or ecx, eax
movzx eax, byte [esi + 5]
or ebp, edx
shld ebp, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [esi + 4]
or ebp, edx
shld ebp, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [esi + 3]
or ebp, edx
shld ebp, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [esi + 2]
or ebp, edx
shld ebp, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [esi + 1]
or ebp, edx
shld ebp, ecx, 8
cdq
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
or ebp, edx
shld ebp, ecx, 8
cdq
shl ecx, 8
or ebp, edx
or ecx, eax
push ebp
push ecx
add esi, 8
call fcn.0053c9e0
xor dword [ebx + edi*8], eax
xor dword [ebx + edi*8 + 4], edx
mov ebp, dword [esp + 0x18]
inc edi
add esp, 8
cmp edi, ebp
jb 0x53cc40
call fcn.0053c890
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub eax, ecx
mov dword [esp + 0x20], eax
cmp eax, ecx
jae 0x53cc30
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret
Function at 0x549740
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
test edx, edx
je 0x54975c
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x549761
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test ebp, ebp
jle 0x549825
push ebx
lea ebx, [ebx]
cmp ebp, 3
movzx edx, byte [edi]
jl 0x5497c2
movzx ebx, byte [edi + 1]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi + 2]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx + 1], bl
inc ecx
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
inc ecx
mov byte [ecx], bl
inc ecx
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx], dl
jmp 0x54980b
shl edx, 0x10
cmp ebp, 2
jne 0x5497d3
movzx ebx, byte [edi + 1]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
inc ecx
mov byte [ecx], bl
inc ecx
cmp ebp, 1
jne 0x5497fb
lea edx, [ebp + 0x3c]
jmp 0x549805
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub ebp, 3
inc ecx
add eax, 4
add edi, 3
test ebp, ebp
jg 0x549770
pop ebx
pop edi
pop esi
mov byte [ecx], 0
pop ebp
ret
pop edi
pop esi
mov byte [ecx], al
pop ebp
ret

Function at 0x54dd50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x54dd69
mov esi, edi
mov edi, eax
jmp 0x54dd6b
mov esi, eax
mov edx, dword [esi + 4]
mov ebx, dword [esp + 0x10]
push edx
push ebx
call fcn.00479900
add esp, 8
test eax, eax
jne 0x54dd84
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x54dda5
jmp 0x54dd90
mov ecx, dword [edi]
mov edx, dword [esi]
mov ecx, dword [ecx + eax*4]
xor ecx, dword [edx + eax*4]
mov edx, dword [ebx]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi + 4]
jl 0x54dd90
cmp eax, dword [esi + 4]
jge 0x54ddc0
lea ebx, [ebx]
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4]
mov edx, dword [ebx]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [esi + 4]
jl 0x54ddb0
mov edx, dword [esi + 4]
push ebx
mov dword [ebx + 4], edx
call fcn.00479340
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x54e010
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 4
call fcn.0055bc20
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor ebp, ebp
push ebx
mov dword [esp + 0x10], ebp
call fcn.004c6420
push ebx
call fcn.004c64c0
mov esi, eax
add esp, 8
test esi, esi
je 0x54e216
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
add eax, eax
push eax
push esi
call fcn.00479900
add esp, 8
test eax, eax
je 0x54e215
mov ecx, dword [edi + 4]
sub ecx, 1
js 0x54e1eb
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
shr edx, 1
and edx, 0x8000
mov ebp, eax
and ebp, 0x20000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x80000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x100000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x200000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x400000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x800000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x1000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x2000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x4000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x8000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x10000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x20000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000000
or edx, ebp
shr edx, 1
and eax, 0x80000001
or edx, eax
mov eax, dword [esi]
shr edx, 1
mov dword [eax + ecx*8 + 4], edx
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
and edx, 0x8000
add edx, edx
mov ebp, eax
and ebp, 0x4000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x2000
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 0x1000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x800
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x400
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x200
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x100
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x80
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x40
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x20
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x10
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 8
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 4
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 2
or edx, ebp
and eax, 1
add edx, edx
or edx, eax
sub ecx, 1
mov eax, dword [esi]
mov dword [eax + ecx*8 + 8], edx
jns 0x54e068
mov ebp, dword [esp + 0x10]
mov ecx, dword [edi + 4]
add ecx, ecx
push esi
mov dword [esi + 4], ecx
call fcn.00479340
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push edx
push esi
push eax
call fcn.0054dde0
add esp, 0x10
test eax, eax
je 0x54e215
mov ebp, 1
pop edi
push ebx
call fcn.004c6480
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x557cb0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x24]
cmp dword [esi], 5
je 0x557ccb
push edi
call fcn.005576b0
add esp, 4
test eax, eax
jle 0x557d14
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi + 0x20]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0047c370
add esp, 8
test esi, esi
jg 0x557d12
push esi
call fcn.004c91e0
add esp, 4
test eax, eax
je 0x557d12
push 0xa
push edi
call fcn.0047c390
add esp, 8
mov eax, esi
pop edi
pop esi
ret

Function at 0x55a67a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5e2ec0]
jne 0x55a684
repz ret
jmp fcn.0055f7f5

Function at 0x56a840
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00560375
and dword [ebp - 4], 0
cmp dword [0x5e96b8], 0
mov ebx, eax
jne 0x56a8f1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x56a9a2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x56a9a2
push eax
call fcn.00560303
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5e96b8], eax
call esi
push eax
call fcn.00560303
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5e96bc], eax
call esi
push eax
call fcn.00560303
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5e96c0], eax
call esi
push eax
call fcn.00560303
pop ecx
mov dword [0x5e96c8], eax
test eax, eax
je 0x56a8f1
push 0x5d3710
push edi
call esi
push eax
call fcn.00560303
pop ecx
mov dword [0x5e96c4], eax
mov eax, dword [0x5e96c4]
cmp eax, ebx
je 0x56a949
cmp dword [0x5e96c8], ebx
je 0x56a949
push eax
call fcn.0056037e
push dword [0x5e96c8]
mov esi, eax
call fcn.0056037e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x56a949
test edi, edi
je 0x56a949
call esi
test eax, eax
je 0x56a940
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x56a940
test byte [ebp - 0xc], 1
jne 0x56a949
or dword [ebp + 0x10], 0x200000
jmp 0x56a982
mov eax, dword [0x5e96bc]
cmp eax, ebx
je 0x56a982
push eax
call fcn.0056037e
pop ecx
test eax, eax
je 0x56a982
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x56a982
mov eax, dword [0x5e96c0]
cmp eax, ebx
je 0x56a982
push eax
call fcn.0056037e
pop ecx
test eax, eax
je 0x56a982
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5e96b8]
call fcn.0056037e
pop ecx
test eax, eax
je 0x56a9a2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x56a9a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b63d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
sub ecx, 0xd98c7e4d
add ecx, ecx
mov ecx, 0xdd012103
call fcn.0043b683
or ecx, ecx
and eax, eax
xor dword [ebx], edi
mov eax, 0x6adadf46
add eax, eax
add ebx, 1
push eax
pop eax
sub eax, ecx
sub eax, 0x55ee1556
cmp ebx, edx
jne fcn.0043b63d
add eax, 0xd46fd86
add eax, 0x161c4963
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x40421b
Capabilities:
Hash data using murmur3

Disassembly:
sub edx, dword [0x42ac54]
mov dword [0x42a65d], ecx
xor eax, ebp
xchg esi, eax
inc esi
xor dword [0x42a762], 0x1361667a
xchg esi, esi
xor edi, dword [0x42ab3a]
neg esi
xor edx, dword [0x42af7f]
inc ebx
add edi, dword [0x42adfd]
add dword [0x42a662], ecx
add dword [0x42a5d4], 0x2ca095ca
sub eax, 0x270e1614
xor dword [0x42a575], ebx
sub esi, dword [0x42af52]
inc esi
dec esi
mov dword [0x42a88c], ecx
add eax, 0x270e1614
mov dword [0x42a8ee], 0x28f24160
dec ebx
neg esi
xchg esi, esi
or dword [0x42a4d9], 0x92991a8
dec esi
xchg esi, eax
xor eax, ebp
mov dword [0x42a680], edi
pop ecx
add ebx, esp
dec eax
sub esi, eax
dec edx
neg eax
mov dword [0x42a8d8], 0x16bfaed0
xor ecx, eax
dec edx
xor ebx, esi
dec ebx
sub esi, eax
sub ecx, dword [0x42ab08]
ror esi, 0x13
xchg edx, eax
add ebx, dword [0x42aadc]
ror esi, 0x11
add edx, dword [0x42aefd]
xor ebx, 0x20b8cfc
ror edx, 0x15
inc eax
rol eax, 1
ror eax, 1
dec eax
rol edx, 0x15
xor ebx, 0x20b8cfc
rol esi, 0x11
xchg edx, eax
rol esi, 0x13
add esi, eax
inc ebx
xor ebx, esi
inc edx
xor ecx, eax
neg eax
inc edx
add esi, eax
inc eax
sub ebx, esp
add ecx, 0x641
not esi
sub esi, esp
xor esi, eax
neg esi
xor ebx, esp
ror esi, 0x16
xor ecx, dword [0x42aab8]
not eax
sub dword [0x42a498], edi
not esi
not esi
mov dword [0x42a606], ecx
not eax
rol esi, 0x16
xor ebx, esp
neg esi
xor esi, eax
add esi, esp
not esi
xor dword [ecx], 0xd2c0b957
rol esi, 0x17
sub edi, 0x2960d308
add ebx, esp
not eax
xor edx, esi
dec edx
sub ebx, dword [0x42aa4a]
xor eax, 0x791edd0
rol ebx, 0x1b
xor ebx, dword [0x42acc0]
xor esi, 0x61a80c8
xchg esi, eax
sub edx, dword [0x42aea8]
mov dword [0x42a6e2], 0x10a36
sub ebx, edi
add ebx, edi
xchg esi, eax
xor esi, 0x61a80c8
ror ebx, 0x1b
xor eax, 0x791edd0
inc edx
xor edx, esi
not eax
sub ebx, esp
add edi, 0x2960d308
ror esi, 0x17
not dword [ecx]
xor ebx, dword [0x42abdd]
inc esi
sub ecx, dword [0x42af29]
or dword [0x42a836], 0xc9c55c0
inc eax
neg esi
ror eax, 0xf
sub eax, 0x2705bb9e
sub edi, dword [0x42add6]
dec eax
mov dword [0x42a92c], 0xe4f03e6
xor ecx, esp
ror eax, 0x12
add edx, ecx
xchg ecx, eax
mov dword [0x42a978], edx
not ebx
xor ebx, edx
xor esi, dword [0x42aeb2]
dec eax
inc eax
xor ebx, edx
not ebx
sub dword [0x42a818], ebx
xchg ecx, eax
sub edx, ecx
rol eax, 0x12
xor ecx, esp
sub dword [0x42a43a], 0x403a391
inc eax
add eax, 0x2705bb9e
rol eax, 0xf
neg esi
dec eax
dec esi
xor dword [ecx], 0xd2c0b957
rol eax, 0x10
add edx, 0x62e8d02
xor ecx, dword [0x42ae1c]
xor ecx, dword [0x42ae15]
xor eax, 0x39d4c9da
neg edi
or dword [0x42a950], 0x1227abe8
neg eax
xor ebx, edx
ror ebx, 1
mov dword [0x42a3ce], 0x4132698
xor esi, eax
xor dword [0x42a95c], edi
not edi
rol eax, 0x11
dec edi
mov dword [0x42a6b3], ecx
mov dword [0x42a608], ecx
add ecx, esi
dec edx
inc edx
sub ecx, esi
inc edi
ror eax, 0x11
not edi
xor esi, eax
xor dword [0x42a4dc], 0x734c8fb
rol ebx, 1
xor ebx, edx
neg eax
neg edi
xor eax, 0x39d4c9da
sub edx, 0x62e8d02
push es
ror eax, 0x10
sub dword [ecx], 0xd2c0b957
add dword [0x42a6c6], ecx
rol edx, 0x14
add edx, dword [0x42a9b4]
xor ecx, eax
add esi, 0xc1bb07
rol edx, 0x1c
xor esi, edx
invalid
Function at 0x404242
Capabilities:
Hash data using murmur3

Disassembly:
rol byte [ecx + 0x77da50c7], 1
add esi, dword [ebx]
int3

Function at 0x404277
Capabilities:
Hash data using murmur3

Disassembly:
mov dl, 0xda
and eax, 0xc7def72f
add eax, 0x42a824
invalid
Function at 0x405ead
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x426dc8
push 0x40a5a4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405efb
push 1
push 0
push esi
call fcn.00405d53
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x40601a
cmp eax, edi
jg 0x40601a
mov esi, 0x4275c8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x40601a
cmp eax, edi
jg 0x40601a
push esi
push ebx
push str._ls_ls_r_n
push 0x4269c8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x42a250]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004061a0
push 4
push 0xc0000000
push esi
call fcn.00405d53
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x40601a
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406013
push edi
push esi
push ebp
call fcn.00405dd6
test eax, eax
je 0x406013
push str._Rename__r_n
push esi
call fcn.00405cb8
test eax, eax
jne 0x405fb1
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405fe6
add eax, 0xa
push 0x40a588
push eax
call fcn.00405cb8
mov ebp, eax
test ebp, ebp
je 0x405fe2
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405fd3
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405fcd
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405fe8
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4269c8
push eax
call fcn.00405d0e
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405e05
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx

Function at 0x40601f
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406042
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405ead
pop ecx
pop ecx
inc dword [0x42a2d0]
ret 8