joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b1c
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0xc8]
cmp byte [eax], 0
je 0x403b5a
push edi
mov edi, dword [esi + 0x58]
test edi, edi
je 0x403b3f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0xc8]
push dword [eax + 4]
call fcn.0040b5ae
pop ecx
push 0x64
mov dword [esi + 0x58], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
ret

Function at 0x40452f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
push str.http:__www.airytec.com_switch_off_
lea esi, [ebp - 0x20]
call fcn.004099a2
sub esp, 0x10
mov edi, esp
lea esi, [ebp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [0x419030]
add esi, 0x70
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
movsd dword es:[edi], dword [esi]
mov esi, esp
push str.01_version23
call fcn.004099a2
lea eax, [ebp - 0x10]
call fcn.00409fa8
add esp, 0x50
push 3
xor ecx, ecx
push ecx
push ecx
push dword [eax]
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x10]
call fcn.00409a00
lea eax, [ebp - 0x20]
call fcn.00409a00
lea eax, [ebp + 8]
call fcn.00409a00
lea eax, [ebp + 0x18]
call fcn.00409a00
pop edi
pop esi
leave
ret 0x20
Function at 0x409856
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x20
pop eax
push 4
push eax
mov dword [0x419064], eax
call fcn.00409647
mov dword [0x419060], eax
mov eax, 0x41534c
mov esi, 0x41535c
pop ecx
pop ecx
mov edi, eax
cmp eax, esi
jae 0x40988e
mov eax, dword [edi]
test eax, eax
je 0x409887
call eax
add edi, 4
cmp edi, esi
jb 0x40987f
push pe_nt_image_headers32
call fcn.004095ce
mov esi, eax
pop ecx
test esi, esi
je 0x4098c9
mov edi, esi
call fcn.0040b1a5
lea edi, [esi + 0x5c]
mov dword [esi], 0x4169b0
call fcn.00404741
push 0x10
lea eax, [esi + 0xac]
push 0
push eax
call fcn.004096a4
add esp, 0xc
jmp 0x4098cb
xor esi, esi
push esi
call fcn.0040acab
test esi, esi
je 0x4098e9
lea eax, [esi + 0x64]
call fcn.00409a00
call fcn.0040b2d6
push esi
call fcn.00409607
pop ecx
mov ecx, dword [0x419068]
test ecx, ecx
je 0x409910
mov eax, dword [0x419060]
lea edi, [eax + ecx*4]
mov esi, eax
cmp eax, edi
jae 0x409910
mov eax, dword [esi]
test eax, eax
je 0x409909
call eax
add esi, 4
cmp esi, edi
jb 0x409901
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40a1ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0x20]
mov ebx, eax
call fcn.004099a2
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0xc]
push ecx
xor esi, esi
push esi
lea ecx, [ebp - 0x10]
push ecx
push esi
push dword [eax]
push dword [ebx]
call edi
lea eax, [ebp - 0x20]
call fcn.00409a00
cmp dword [ebp - 0xc], esi
jbe 0x40a261
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x40a208
cmp eax, 2
je 0x40a208
cmp eax, 4
jne 0x40a1fe
push eax
jmp 0x40a21c
cmp eax, 3
jne 0x40a225
push dword [ebp - 0xc]
jmp 0x40a21c
mov eax, dword [ebp - 0xc]
push 2
xor ecx, ecx
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or eax, ecx
push eax
call fcn.004095ce
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
lea esi, [ebp - 0x20]
call fcn.004099a2
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 8]
push 0
push 0
push eax
push dword [ebx]
call edi
mov ebx, eax
neg ebx
mov eax, esi
sbb bl, bl
call fcn.00409a00
inc bl
je 0x40a258
mov eax, dword [ebp - 8]
jmp 0x40a263
push dword [ebp - 8]
call fcn.00409607
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40afab
Capabilities:
Terminate thread

Disassembly:
xor eax, eax
cmp dword [esi + 0x14], eax
je 0x40afe8
push eax
push eax
push 0x12
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0xbb8
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40afdf
push 1
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea ebx, [esi + 4]
call fcn.0040b8c6
push esi
call fcn.00409607
pop ecx
mov eax, esi
pop ebx
ret

Function at 0x40b1a5
Capabilities:
Accept command line arguments
Hash data using murmur3
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push esi
lea ebx, [edi + 0xc]
mov esi, ebx
mov dword [edi], 0x417198
call fcn.0040993c
xor esi, esi
push 0x10
lea eax, [edi + 0x30]
push esi
push eax
mov dword [edi + 0x1c], esi
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], esi
call fcn.004096a4
add esp, 0xc
push esi
mov dword [0x419034], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0xc]
call fcn.00409aab
pop ecx
mov esi, ebx
call fcn.00409bba
lea eax, [esp + 8]
call fcn.00409a00
push 0x417134
lea esi, [esp + 0xc]
call fcn.004099a2
cmp dword [ebx + 8], 1
jl 0x40b256
mov esi, dword [ebx]
push dword [esp + 8]
lea eax, [esi + 2]
call fcn.004096fe
pop ecx
test eax, eax
je 0x40b256
cmp eax, esi
jne 0x40b243
lea eax, [esp + 8]
call fcn.00409a00
xor eax, eax
jmp 0x40b262
sub eax, esi
sar eax, 1
mov esi, eax
lea eax, [esp + 8]
call fcn.00409a00
mov eax, esi
jmp 0x40b262
lea eax, [esp + 8]
call fcn.00409a00
or eax, 0xffffffff
lea ecx, [eax + 1]
mov eax, dword [edi + 0x14]
lea edx, [esp + 8]
push edx
push ebx
sub eax, ecx
mov ebx, ecx
call fcn.00409e2c
sub esp, 0x10

Function at 0x40b2d6
Capabilities:
Hash data using murmur3

Disassembly:
mov esi, esp
push 0x417138
call fcn.004099a2
sub esp, 0x10
mov esi, esp
push 0x416c78
call fcn.004099a2
sub esp, 0x10
lea ecx, [esp + 0x38]
mov eax, esp
push ecx
call fcn.0040996d
lea eax, [edi + 0x1c]
push eax
xor eax, eax
call fcn.0040f090
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x28], eax
mov eax, dword [edi + 8]
mov dword [edi + 0x2c], eax
lea eax, [esp + 8]
sub al, 0x8d
inc esp
and al, 8
call fcn.00409a00
pop esi
mov eax, edi
mov esi, eax
xchg edx, eax
xor eax, eax
sal bh, 0xd7
test eax, 0x894fe42
jo 0x40b27a
rol eax, 0x1d
sub edi, dword [0x4190dc]
ror esi, 0x1b
call fcn.00409935
mov dword [0x4191e6], ecx
xchg ecx, eax
inc ecx
add cl, al
rcr byte [ebx], 0x81
mul byte [esi + 0x59]
jecxz 0x40b303
xchg ecx, eax
inc ecx
add cl, al
rcr byte [ebx], 0x81
mul byte [esi + 0x59]
jecxz 0x40b303
inc ebx
invalid
invalid
invalid
Function at 0x40b2f5
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
mov esi, esp
push 0x417138
call fcn.004099a2
sub esp, 0x10
mov esi, esp
push 0x416c78
call fcn.004099a2
sub esp, 0x10
lea ecx, [esp + 0x38]
mov eax, esp
push ecx
call fcn.0040996d
lea eax, [edi + 0x1c]
push eax
xor eax, eax
call fcn.0040f090
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x28], eax
mov eax, dword [edi + 8]
mov dword [edi + 0x2c], eax
lea eax, [esp + 8]
sub al, 0x8d
inc esp
and al, 8
call fcn.00409a00
pop esi
mov eax, edi
mov esi, eax
xchg edx, eax
xor eax, eax
sal bh, 0xd7
test eax, 0x894fe42
jo 0x40b27a
rol eax, 0x1d
sub edi, dword [0x4190dc]
ror esi, 0x1b
call fcn.00409935
mov dword [0x4191e6], ecx
xchg ecx, eax
inc ecx
add cl, al
rcr byte [ebx], 0x81
mul byte [esi + 0x59]
jecxz 0x40b303
xchg ecx, eax
inc ecx
add cl, al
rcr byte [ebx], 0x81
mul byte [esi + 0x59]
jecxz 0x40b303
inc ebx
invalid
invalid
invalid
Function at 0x40b450
Capabilities:
Hash data using murmur3

Disassembly:
cmp al, byte [esi + 0x2d81ffff]
pushal
cwde
inc ecx
add byte [ecx - 0x44fd9b4f], al
xchg byte [esi], al
add byte [eax], al
rol edi, 0x12
or dword [0x4196b8], 0x2eded44
call fcn.00402e0d
add esi, eax
sub edx, dword [0x419d46]
add esi, eax
sub ebx, 0x182e7982
mov dword [0x419224], 0x150f46fe
xor esi, eax
xor eax, 0x7afa8e2
xor eax, 0x7afa8e2
xor esi, eax
and dword [0x4197e4], 0x4716cb0
add ebx, 0x182e7982
sub esi, eax
sub esi, eax
call fcn.00403fcd
or dword [0x41957c], 0xda57423
ror edi, 0x12
push ebx
xor dword [0x4193c8], 0x36b1f254
neg edx
mov dword [0x41921a], 0x15fac753
sub ebx, esp
add ecx, dword [0x419a46]
ror ecx, 0xf
add edx, 0x5048d96
xor ecx, dword [0x419ef8]
rol esi, 0xc
xor ebx, dword [0x419a48]
sub ebx, dword [0x419d45]
xor esi, edi
sub ecx, dword [0x419b9c]
sub esi, eax
add esi, eax
xor esi, edi
ror esi, 0xc
sub edx, 0x5048d96
rol ecx, 0xf
add ebx, esp
neg edx
and dword [0x419740], 0x1691deac
push 0
xor edi, eax
sub esi, dword [0x419cc9]
xor edx, dword [0x419a5e]
dec eax
mov dword [0x4197e8], 0x74d24
mov dword [0x419585], ecx
sub dword [0x419356], edx
mov dword [0x4195c9], ecx
sub esi, 0x1137b205
xor esi, 0x38cca08
call fcn.00404438
neg esi
dec esi
mov dword [0x419662], 0x2366c70
xor dword [0x419337], 0x7de2fa8
inc esi
neg esi
call fcn.00408fca
xor esi, 0x38cca08
add esi, 0x1137b205
or dword [0x419218], esi
xor dword [0x41920c], ebx
sub dword [0x419260], ecx
mov dword [0x4197ca], 0x1c80bf3f
sbb al, 0x40
xor edi, eax
push 0x40
sub edx, dword [0x4199fa]
rol eax, 0x11
neg esi
mov dword [0x4198a5], 0x141d01cd
rol eax, 0x1a
not esi
xor esi, eax
xor eax, ebx
sub edx, dword [0x4199a4]
dec eax
xchg edx, edx
xor edi, esp
xor edi, esp
xchg edx, edx
inc eax
xor eax, ebx
xor esi, eax
not esi
ror eax, 0x1a
or dword [0x41930b], 0x339d389
neg esi
ror eax, 0x11
push 0
xor esi, dword [0x419cce]
pushfd
inc ecx
add byte [edx + 0x2b], cl
sal dword [ebx], cl
salc
rol edx, 0x14
xor dword [0x41964c], ecx
xor ebx, eax
sub esi, dword [0x419f96]
sub ecx, esp
xor esi, 0x19cf0788
sub edi, dword [0x4199c2]
sub eax, ebp
sub edx, dword [0x419cd6]
neg eax
call fcn.00404f7a
sub ebx, dword [0x419a10]
call fcn.0040655f
neg eax
add eax, ebp
xor esi, 0x19cf0788
add ecx, esp
xor ebx, eax
ror edx, 0x14
xor edx, esi
add edx, ebx
inc edx
push 0xffffffffffffffff
mov dword [0x419797], ecx
ror ecx, 7
xor esi, eax
call fcn.0040327b
sub ecx, edx
xor edi, ebp
xor eax, 0x7d114f0
xchg eax, edx
xor esi, dword [0x419be4]
sub ecx, esp
call fcn.004085a7
dec esi
call fcn.00405497
or dword [0x419874], 0xf68730c
xor esi, eax
add esi, eax
sub esi, eax
call fcn.004076a9
not edx
add esi, dword [0x419e63]
not edx
call fcn.00405497
add esi, eax
sub esi, eax
xor esi, eax
xor dword [0x419397], 0xd24686
call fcn.00407cbf
inc esi
call fcn.004082a3
add ecx, esp
xchg eax, edx
xor eax, 0x7d114f0
xor edi, ebp
add ecx, edx
xor esi, eax
rol ecx, 7
or dword [0x419785], edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
neg eax
call fcn.004026dd
sub edi, dword [0x419abf]
xor esi, eax
ror eax, 0x19
invalid
invalid
mov ah, 0x94
Function at 0x40b5ae
Capabilities:
Hash data using murmur3

Disassembly:
cmp al, byte [esi + 0x2d81ffff]
pushal
cwde
inc ecx
add byte [ecx - 0x44fd9b4f], al
xchg byte [esi], al
add byte [eax], al
rol edi, 0x12
or dword [0x4196b8], 0x2eded44
call fcn.00402e0d
add esi, eax
sub edx, dword [0x419d46]
add esi, eax
sub ebx, 0x182e7982
mov dword [0x419224], 0x150f46fe
xor esi, eax
xor eax, 0x7afa8e2
xor eax, 0x7afa8e2
xor esi, eax
and dword [0x4197e4], 0x4716cb0
add ebx, 0x182e7982
sub esi, eax
sub esi, eax
call fcn.00403fcd
or dword [0x41957c], 0xda57423
ror edi, 0x12
push ebx
xor dword [0x4193c8], 0x36b1f254
neg edx
mov dword [0x41921a], 0x15fac753
sub ebx, esp
add ecx, dword [0x419a46]
ror ecx, 0xf
add edx, 0x5048d96
xor ecx, dword [0x419ef8]
rol esi, 0xc
xor ebx, dword [0x419a48]
sub ebx, dword [0x419d45]
xor esi, edi
sub ecx, dword [0x419b9c]
sub esi, eax
add esi, eax
xor esi, edi
ror esi, 0xc
sub edx, 0x5048d96
rol ecx, 0xf
add ebx, esp
neg edx
and dword [0x419740], 0x1691deac
push 0
xor edi, eax
sub esi, dword [0x419cc9]
xor edx, dword [0x419a5e]
dec eax
mov dword [0x4197e8], 0x74d24
mov dword [0x419585], ecx
sub dword [0x419356], edx
mov dword [0x4195c9], ecx
sub esi, 0x1137b205
xor esi, 0x38cca08
call fcn.00404438
neg esi
dec esi
mov dword [0x419662], 0x2366c70
xor dword [0x419337], 0x7de2fa8
inc esi
neg esi
call fcn.00408fca
xor esi, 0x38cca08
add esi, 0x1137b205
or dword [0x419218], esi
xor dword [0x41920c], ebx
sub dword [0x419260], ecx
mov dword [0x4197ca], 0x1c80bf3f
sbb al, 0x40
xor edi, eax
push 0x40
sub edx, dword [0x4199fa]
rol eax, 0x11
neg esi
mov dword [0x4198a5], 0x141d01cd
rol eax, 0x1a
not esi
xor esi, eax
xor eax, ebx
sub edx, dword [0x4199a4]
dec eax
xchg edx, edx
xor edi, esp
xor edi, esp
xchg edx, edx
inc eax
xor eax, ebx
xor esi, eax
not esi
ror eax, 0x1a
or dword [0x41930b], 0x339d389
neg esi
ror eax, 0x11
push 0
xor esi, dword [0x419cce]
pushfd
inc ecx
add byte [edx + 0x2b], cl
sal dword [ebx], cl
salc
rol edx, 0x14
xor dword [0x41964c], ecx
xor ebx, eax
sub esi, dword [0x419f96]
sub ecx, esp
xor esi, 0x19cf0788
sub edi, dword [0x4199c2]
sub eax, ebp
sub edx, dword [0x419cd6]
neg eax
call fcn.00404f7a
sub ebx, dword [0x419a10]
call fcn.0040655f
neg eax
add eax, ebp
xor esi, 0x19cf0788
add ecx, esp
xor ebx, eax
ror edx, 0x14
xor edx, esi
add edx, ebx
inc edx
push 0xffffffffffffffff
mov dword [0x419797], ecx
ror ecx, 7
xor esi, eax
call fcn.0040327b
sub ecx, edx
xor edi, ebp
xor eax, 0x7d114f0
xchg eax, edx
xor esi, dword [0x419be4]
sub ecx, esp
call fcn.004085a7
dec esi
call fcn.00405497
or dword [0x419874], 0xf68730c
xor esi, eax
add esi, eax
sub esi, eax
call fcn.004076a9
not edx
add esi, dword [0x419e63]
not edx
call fcn.00405497
add esi, eax
sub esi, eax
xor esi, eax
xor dword [0x419397], 0xd24686
call fcn.00407cbf
inc esi
call fcn.004082a3
add ecx, esp
xchg eax, edx
xor eax, 0x7d114f0
xor edi, ebp
add ecx, edx
xor esi, eax
rol ecx, 7
or dword [0x419785], edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
neg eax
call fcn.004026dd
sub edi, dword [0x419abf]
xor esi, eax
ror eax, 0x19
invalid
invalid
mov ah, 0x94
Function at 0x40b5ff
Capabilities:
Hash data using murmur3

Disassembly:
cmp al, byte [esi + 0x2d81ffff]
pushal
cwde
inc ecx
add byte [ecx - 0x44fd9b4f], al
xchg byte [esi], al
add byte [eax], al
rol edi, 0x12
or dword [0x4196b8], 0x2eded44
call fcn.00402e0d
add esi, eax
sub edx, dword [0x419d46]
add esi, eax
sub ebx, 0x182e7982
mov dword [0x419224], 0x150f46fe
xor esi, eax
xor eax, 0x7afa8e2
xor eax, 0x7afa8e2
xor esi, eax
and dword [0x4197e4], 0x4716cb0
add ebx, 0x182e7982
sub esi, eax
sub esi, eax
call fcn.00403fcd
or dword [0x41957c], 0xda57423
ror edi, 0x12
push ebx
xor dword [0x4193c8], 0x36b1f254
neg edx
mov dword [0x41921a], 0x15fac753
sub ebx, esp
add ecx, dword [0x419a46]
ror ecx, 0xf
add edx, 0x5048d96
xor ecx, dword [0x419ef8]
rol esi, 0xc
xor ebx, dword [0x419a48]
sub ebx, dword [0x419d45]
xor esi, edi
sub ecx, dword [0x419b9c]
sub esi, eax
add esi, eax
xor esi, edi
ror esi, 0xc
sub edx, 0x5048d96
rol ecx, 0xf
add ebx, esp
neg edx
and dword [0x419740], 0x1691deac
push 0
xor edi, eax
sub esi, dword [0x419cc9]
xor edx, dword [0x419a5e]
dec eax
mov dword [0x4197e8], 0x74d24
mov dword [0x419585], ecx
sub dword [0x419356], edx
mov dword [0x4195c9], ecx
sub esi, 0x1137b205
xor esi, 0x38cca08
call fcn.00404438
neg esi
dec esi
mov dword [0x419662], 0x2366c70
xor dword [0x419337], 0x7de2fa8
inc esi
neg esi
call fcn.00408fca
xor esi, 0x38cca08
add esi, 0x1137b205
or dword [0x419218], esi
xor dword [0x41920c], ebx
sub dword [0x419260], ecx
mov dword [0x4197ca], 0x1c80bf3f
sbb al, 0x40
xor edi, eax
push 0x40
sub edx, dword [0x4199fa]
rol eax, 0x11
neg esi
mov dword [0x4198a5], 0x141d01cd
rol eax, 0x1a
not esi
xor esi, eax
xor eax, ebx
sub edx, dword [0x4199a4]
dec eax
xchg edx, edx
xor edi, esp
xor edi, esp
xchg edx, edx
inc eax
xor eax, ebx
xor esi, eax
not esi
ror eax, 0x1a
or dword [0x41930b], 0x339d389
neg esi
ror eax, 0x11
push 0
xor esi, dword [0x419cce]
pushfd
inc ecx
add byte [edx + 0x2b], cl
sal dword [ebx], cl
salc
rol edx, 0x14
xor dword [0x41964c], ecx
xor ebx, eax
sub esi, dword [0x419f96]
sub ecx, esp
xor esi, 0x19cf0788
sub edi, dword [0x4199c2]
sub eax, ebp
sub edx, dword [0x419cd6]
neg eax
call fcn.00404f7a
sub ebx, dword [0x419a10]
call fcn.0040655f
neg eax
add eax, ebp
xor esi, 0x19cf0788
add ecx, esp
xor ebx, eax
ror edx, 0x14
xor edx, esi
add edx, ebx
inc edx
push 0xffffffffffffffff
mov dword [0x419797], ecx
ror ecx, 7
xor esi, eax
call fcn.0040327b
sub ecx, edx
xor edi, ebp
xor eax, 0x7d114f0
xchg eax, edx
xor esi, dword [0x419be4]
sub ecx, esp
call fcn.004085a7
dec esi
call fcn.00405497
or dword [0x419874], 0xf68730c
xor esi, eax
add esi, eax
sub esi, eax
call fcn.004076a9
not edx
add esi, dword [0x419e63]
not edx
call fcn.00405497
add esi, eax
sub esi, eax
xor esi, eax
xor dword [0x419397], 0xd24686
call fcn.00407cbf
inc esi
call fcn.004082a3
add ecx, esp
xchg eax, edx
xor eax, 0x7d114f0
xor edi, ebp
add ecx, edx
xor esi, eax
rol ecx, 7
or dword [0x419785], edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
neg eax
call fcn.004026dd
sub edi, dword [0x419abf]
xor esi, eax
ror eax, 0x19
invalid
invalid
mov ah, 0x94
Function at 0x40b6fb
Capabilities:
Hash data using murmur3

Disassembly:
inc ecx
add byte [ebp - 0x3edc91f8], bl
into
sbb al, 0x33
invalid

Function at 0x40b877
Capabilities:
Hash data using murmur3

Disassembly:
neg eax
xor esi, eax
not ebx
rol esi, 0x15
add esi, eax
add dword [0x4194a4], 0xc7971b7
dec edx
call fcn.00405777
push 0x22
dec esi
mov dword [0x419803], ecx
call fcn.00407061
add edi, eax
xor esi, eax
sub edi, edx
or dword [0x419712], 0xaca9eb0
call fcn.00406aa4
sub ecx, dword [0x419b48]
xor dword [0x419608], 0xba478
not ebx
shr eax, cl
sbb dword [edi + edi*8 - 1], edi

Function at 0x40b8c6
Capabilities:
Hash data using murmur3

Disassembly:
shr eax, cl
sbb dword [edi + edi*8 - 1], edi
xchg eax, eax
mov dword [0x419200], 0x7fa5900
call fcn.00402364
xchg edx, edx
or dword [0x4198de], esi
xchg edx, edx
call fcn.0040655f
mov dword [0x4198dc], 0xd842c24
test byte [0xa7e8c087], cl
mov cl, 0xff
push edi
rol dword [ecx + 0x41924c35], cl
add byte [ecx + 0x11], dh
push ds
invalid

Function at 0x40b8f4
Capabilities:
Hash data using murmur3

Disassembly:
test byte [0xa7e8c087], cl
mov cl, 0xff
push edi
rol dword [ecx + 0x41924c35], cl
add byte [ecx + 0x11], dh
push ds
add al, ch
call fcn.00405497
add dword [0x4198c0], 0x1633bbf0
add edi, edx
xor esi, eax
sub edi, eax
mov dword [0x41978e], edx
inc esi
push eax
or dword [0x419200], edx
mov dword [0x4192bc], 0x3671e4
dec eax
neg eax
sub ecx, dword [0x419d58]
xchg eax, eax
neg esi
sub ecx, dword [0x419f3c]
xor esi, eax
xor esi, 0x1e1c5b37
xor esi, eax
dec esi
xor eax, 0xfcb8115
add esi, eax
xchg esi, eax
call fcn.00406fb4
xor esi, eax
xor esi, eax
call fcn.004051ef
xchg esi, eax
sub esi, eax
xor eax, 0xfcb8115
inc esi
xor esi, eax
xor esi, 0x1e1c5b37
xor esi, eax
neg esi
xchg eax, eax
neg eax
inc eax
xor dword [0x419322], 0x2627600a
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
inc eax
neg esi
xor edi, ebx
not eax
xchg esi, esi
dec eax
sub esi, esp
rol eax, 0x18
mov dword [0x41934c], 0x1e9278a9
invalid

Function at 0x40b909
Capabilities:
Hash data using murmur3

Disassembly:
test byte [0xa7e8c087], cl
mov cl, 0xff
push edi
rol dword [ecx + 0x41924c35], cl
add byte [ecx + 0x11], dh
push ds
add al, ch
call fcn.00405497
add dword [0x4198c0], 0x1633bbf0
add edi, edx
xor esi, eax
sub edi, eax
mov dword [0x41978e], edx
inc esi
push eax
or dword [0x419200], edx
mov dword [0x4192bc], 0x3671e4
dec eax
neg eax
sub ecx, dword [0x419d58]
xchg eax, eax
neg esi
sub ecx, dword [0x419f3c]
xor esi, eax
xor esi, 0x1e1c5b37
xor esi, eax
dec esi
xor eax, 0xfcb8115
add esi, eax
xchg esi, eax
call fcn.00406fb4
xor esi, eax
xor esi, eax
call fcn.004051ef
xchg esi, eax
sub esi, eax
xor eax, 0xfcb8115
inc esi
xor esi, eax
xor esi, 0x1e1c5b37
xor esi, eax
neg esi
xchg eax, eax
neg eax
inc eax
xor dword [0x419322], 0x2627600a
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
inc eax
neg esi
xor edi, ebx
not eax
xchg esi, esi
dec eax
sub esi, esp
rol eax, 0x18
mov dword [0x41934c], 0x1e9278a9
invalid
Function at 0x40cd40
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, edi
mov byte [edi + 4], 0
call fcn.0040d1af
mov eax, dword [edi + 0x90]
test eax, eax
je 0x40cda1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov eax, dword [edi + 0xa4]
and dword [edi + 0x90], 0
test eax, eax
je 0x40cda1
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40cd92
push 1
push dword [edi + 0xa4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0xa4]
call ebx
and dword [edi + 0xa4], 0
lea ebx, [edi + 0xb4]
call fcn.0040d8c7
lea ebx, [edi + 0xa8]
call fcn.0040d898
lea eax, [edi + 0x80]
call fcn.00409a00
lea esi, [edi + 0x20]
call fcn.00411030
pop esi
lea eax, [edi + 8]
pop ebx
jmp fcn.00409a00

Function at 0x40d14d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [esi + 0xb0], edi
jne 0x40d160
xor al, al
jmp 0x40d1ac
cmp dword [esi + 0x98], edi
jne 0x40d1aa
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
push edi
push edi
push edi
push edi
mov dword [esi + 0x98], eax
call ebx
mov dword [esi + 0x9c], eax
pop ebx
cmp dword [esi + 0xa0], edi
jne 0x40d1aa
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x40cdf3
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xa0], eax
mov al, 1
pop edi
leave
ret

Function at 0x40d1af
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x98]
test eax, eax
je 0x40d219
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esi + 0x98]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x9c]
call edi
mov eax, dword [esi + 0xa0]
and dword [esi + 0x98], 0
test eax, eax
je 0x40d218
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40d209
push 0xffffffffffffffff
push dword [esi + 0xa0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0xa0]
call edi
and dword [esi + 0xa0], 0
pop edi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x40d22b
mov eax, dword [ecx]
push 1
call dword [eax + 0x18]
and dword [esi + 0x18], 0
ret

Function at 0x40d338
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [edi + 0xbc], ebx
je 0x40d391
push esi
cmp dword [edi + 0x90], ebx
jne 0x40d362
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x90], eax
push 1
push dword [edi + 0xa4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
cmp eax, 0x102
je 0x40d391
lea eax, [ebp - 4]
push eax
push ebx
push edi
push 0x40d03b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xa4], eax
pop ebx
leave
ret