joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436390
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8c
mov eax, dword [0x462080]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
lea eax, [esp + 8]
push esi
push edi
push eax
mov edi, dword [ebp + 0x538]
lea eax, [esp + 0x1c]
mov ebx, dword [ebp]
push eax
mov dword [esp + 0x18], 0x80
mov eax, dword [edi + 0x154]
push 0
add eax, 4
push eax
push dword [edi + 0x15c]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x148], 0
mov dword [edi + 0x14c], eax
jne 0x436416
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [edi + 0xc8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x148], eax
mov edx, dword [edi + 0x14c]
cmp edx, 4
jge 0x436451
push str.Received_too_short_packet
push ebx
call fcn.0041d7c0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044fd45
add esp, 0x8c
ret
mov eax, dword [edi + 0x15c]
movzx ecx, byte [eax]
movzx eax, byte [eax + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x436472
jmp dword [ecx*4 + 0x436598]
cmp edx, 4
jle case.0x436472.4
mov esi, dword [edi + 0x15c]
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x40]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x436472.4
lea eax, [edx - 4]
push eax
lea eax, [esi + 4]
push eax
push 1
push ebp
call fcn.0041d700
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4364d0
push 5
push edi
call fcn.00436e70
add esp, 8
mov eax, esi
jmp 0x436438
mov eax, dword [edi + 0x14c]
sub eax, 4
cdq
add dword [ebx + 0xb0], eax
adc dword [ebx + 0xb4], edx
push dword [ebx + 0xb4]
push dword [ebx + 0xb0]
push ebx
call fcn.0042aa60
jmp 0x43656c
mov eax, dword [edi + 0x15c]
lea esi, [edx - 4]
push esi
lea ecx, [eax + 4]
mov dword [esp + 0x18], ecx
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
push dword [esp + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 8], ecx
call fcn.00436080
add esp, 8
cmp eax, esi
jae case.0x436472.4
push dword [esp + 0x14]
push str.TFTP_error:__s_n
push ebx
call fcn.0041d8a0
jmp 0x43656c
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x15c]
add eax, 2
push eax
push edi
call fcn.00436120
add esp, 0xc
test eax, eax
je case.0x436472.4
jmp 0x436438
push str.Internal_error:_Unexpected_packet
push 0x45963c
push ebx
call fcn.0041d7c0
add esp, 0xc
push ebp
call fcn.0042ae10
add esp, 4
test eax, eax
je 0x436436
push 5
push edi
call fcn.00436e70
add esp, 8
mov eax, 0x2a
jmp 0x436438
Function at 0x43cf90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x462080]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x80
push eax
mov ebp, dword [edi + 0x1ac]
or esi, 0xffffffff
mov ebx, dword [edi]
push ebp
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x43cff2
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x80
push eax
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push edi
call fcn.0041e2a0
add esp, 8
cmp esi, 0xffffffff
jne 0x43d016
push str.Error_accept__ing_server_connect
push ebx
call fcn.0041d7c0
add esp, 8
mov eax, 0x1e
jmp 0x43d085
push str.Connection_accepted_from_server_n
push ebx
call fcn.0041d8a0
push 1
mov byte [edi + 0x28c], 0
push esi
mov dword [edi + 0x1ac], esi
call fcn.00445490
add esp, 0x10
mov byte [edi + 0x1b9], 1
cmp dword [ebx + 0x630], 0
je 0x43d083
push 1
push ebx
call fcn.0040ef20
mov eax, dword [ebx + 0x630]
push 1
push esi
push dword [ebx + 0x634]
call eax
push 0
push ebx
mov esi, eax
call fcn.0040ef20
add esp, 0x1c
test esi, esi
je 0x43d083
push edi
call fcn.0043d540
add esp, 4
mov eax, 0x2a
jmp 0x43d085
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044fd45
add esp, 0x88
ret
Function at 0x44a800
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x44a810
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x44a8fe
test esi, esi
je 0x44a835
lea eax, [esi + esi]
push eax
call dword [section..data]
jmp 0x44a840
push 0x45e3c8
call dword [0x46200c]
mov edi, eax
add esp, 4
test edi, edi
je 0x44a8fe
xor ecx, ecx
test esi, esi
je 0x44a863
mov al, byte [ecx + ebx]
mov byte [edi + ecx*2], al
mov byte [edi + ecx*2 + 1], 0
inc ecx
cmp ecx, esi
jb 0x44a853
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x44a8e0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x44a8d4
push 0
lea eax, [esi + esi]
mov dword [esp + 0x18], 0x10
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push 2
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx + 0x14], 0
call dword [0x462004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
add esp, 0xc
ret
Function at 0x44a910
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x462080]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov edi, dword [esp + 0x30]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44aa10
push esi
mov esi, dword [esp + 0x38]
push 8
mov dword [esp + 0x18], 0x208
mov dword [esp + 0x1c], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [esp + 0x24], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [esp + 0x25], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [esp + 0x26], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [esp + 0x27], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [esp + 0x28], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [esp + 0x29], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [esp + 0x20], 8
mov byte [esp + 0x2a], al
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x2f], cl
call fcn.0044e560
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x44aa22
push eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0044fd45
add esp, 0x24
ret
mov ecx, dword [esp + 0x2c]
push dword [esp + 8]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
lea eax, [esp + 0xc]
push eax
push edi
push 0
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
xor ecx, esp
call fcn.0044fd45
add esp, 0x24
ret
Function at 0x44fba0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x44fbc7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x44fc12
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x44fc16
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x44fc76
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x44fc35
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x44fca7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x45e287
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x45e288
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x44fc80
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x421b97
Capabilities:
Hide graphical window

Disassembly:
and dword [0x44a7fc], 0
push esi
mov esi, ecx
mov byte [0x44a7e8], 1
push 1
push esi
mov byte [0x44a7e9], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
pop edx
mov ecx, esi
call fcn.004021fd
mov ecx, 0x44ae90
call fcn.00405d1e
test al, al
je 0x421bdb
cmp byte [0x44a7ee], 0
je 0x421be4
cmp dword [0x44a7f0], 0
jne 0x421bf4
push 0
push 1
push 0x111
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret

Function at 0x421c56
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x439c8c
call fcn.00438b26
mov esi, ecx
cmp byte [0x44a9bc], 0
je 0x421cf8
mov ebx, 0x44a9c0
mov ecx, ebx
call fcn.00405d1e
test al, al
jne 0x421cf8
lea ecx, [ebp - 0x28]
call fcn.004021e6
xor edi, edi
lea edx, [ebp - 0x28]
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00421bf6
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x421cf0
mov ecx, esi
call fcn.00401891
lea edx, [eax*2 + 2]
call fcn.0040126f
push edx
push eax
push 1
push edi
lea ecx, [ebp - 0x28]
call fcn.0040126f
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
call fcn.00401e5c
call fcn.00438ad5
ret

Function at 0x423fba
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x423ff9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x423ff9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x423ff9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x423ff9
cmp dword [ecx + 0x74], 0xe
jbe 0x423ff9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x427fb3
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
aad 0x43
add byte [eax + 0xc], ch
aad 0x43
add byte [edx + 4], ch
call fcn.00427d92
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427fa4
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x43c270]
call esi
jmp 0x427fb0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop esi
pop ebp
mov esi, eax
invalid
sub eax, eax
rol esi, 4
mov eax, 0xbfdad94
and esi, edi
and eax, 0x1ac9c6dc
mov esi, eax
dec edi
rol esi, 1
and esi, edi
xor edx, esi
loopne 0x427f77
cmp ecx, dword [ebx + 0x3e2c1f0]

Function at 0x427fd0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, ebp
not esi
call fcn.00406782
add esi, edx
sub esi, eax
rol eax, 1
not edi
or esi, edi
not eax
mov dword [0x4492a2], 0x3b88e05b
loopne 0x427f77
cmp ecx, dword [ebx + 0x3e2c1f0]
rol bh, 1
add eax, 0x4492a2
pop ebx
or eax, 0x43cac9c
test eax, esi
jo 0x427fe5
call fcn.004034b8
or esi, dword [0x44988b]
shl eax, 6
or esi, edi
invalid
Function at 0x427fed
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
aad 0x43
add byte [eax + 0xc], ch
aad 0x43
add byte [edx + 4], ch
call fcn.00427d92
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427fa4
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x43c270]
call esi
jmp 0x427fb0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop esi
pop ebp
mov esi, eax
invalid
sub eax, eax
rol esi, 4
mov eax, 0xbfdad94
and esi, edi
and eax, 0x1ac9c6dc
mov esi, eax
dec edi
rol esi, 1
and esi, edi
xor edx, esi
loopne 0x427f77
cmp ecx, dword [ebx + 0x3e2c1f0]

Function at 0x428000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov ah, 0xb4
std
dec dword [ebx]
xor eax, 0x44988b
Function at 0x428033
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub dword [0x4499a8], ecx
shr edi, 7
xchg esi, eax
dec eax
mov dword [vtable.type_info.0], 0x2a5e704
xchg ebx, eax
xchg eax, esi
inc edi
ror edx, 9
dec eax
loop 0x428018
rol eax, 0xc
test eax, esi
jo 0x42804e
or esi, edi
mov edx, esi
ror esi, 0x18
xor edi, eax
neg esi
call fcn.00408fb6
ror esi, 0x15
mov ecx, 0x30cd306
rol esi, 5
mov dword [0x449818], 0x16aa9ff4
neg edx
inc esi
mov dword [0x4496bc], 0x7451c97
neg esi
xchg esi, esi
sub dword [0x449a4e], ecx
dec esi
lcall 0xfde3, 0x24e80044
inc ecx
jmp 0x428088
not edx
xor dword [0x449c8c], 0x91574b8
xor ebx, dword [0x449aff]
inc eax
loop 0x42805b
mov ecx, 0x1f134174
xor dword [0x4497bb], ebx
inc eax
not eax
xchg eax, esi
shr eax, 0x1b
ror eax, 0x14
neg esi
test edi, ebp
jo 0x42803a
inc edx
loop 0x4280a1
call fcn.004034ac
test eax, eax
jb 0x4280d3
xchg esi, esi
add esi, eax
or esi, edi
and edi, 0x277edd4
ror esi, 0x1b
add esi, 0x81335eb
xor edi, eax
not eax
xor ebx, dword [0x44915a]
shr edi, 5
or esi, edi
call fcn.00410834
xor edx, ecx
inc edx
xor edx, edx
mov edx, eax
xor esi, eax
push 0
inc eax
rol eax, 0x15
sub ebx, dword [0x449676]
mov dword [0x4566f4], 0x27c42bb0
call fcn.00405d1d
xor eax, eax
rol esi, 0x14
xor ecx, dword [0x449888]
not eax
xor dword [0x456705], 0x28be3685
add ebx, dword [0x4497ec]
rol eax, 0x1e
xor edi, dword [0x44918a]
not ecx
dec esi
mov dword [0x456874], esi
mov dword [0x456648], 0x6188039
sub esi, eax
add esi, 0x1802f2c0
call fcn.00410834
mov dword [0x4565ec], ecx
neg esi
call fcn.004080b6
xor dword [0x456903], ecx
mov dword [0x4568c2], 0x1964aeeb
call fcn.00404280
push 0x320033
rol esi, 7
inc esi
add esi, 0x22e26250
call fcn.004088f0
xor esi, eax
dec esi
xor ebx, dword [0x449986]
ror eax, 0x1a
inc ecx
xor dword [0x456995], 0x3f9ce82
mov dword [0x4569f2], esi
inc eax
ror esi, 0xa
dec esi
xor dword [0x456686], esi
mov dword [0x456898], esi
mov dword [0x456854], 0x1f57d270
mov dword [0x456622], edi
sub dword [0x4566a8], edi
mov dword [0x456941], esi
mov dword [0x45678a], 0x27c19e0
call fcn.004028c9
push 0x6c0065
dec esi
xor dword [0x456a24], 0x4a9115f
xchg esi, eax
call fcn.00406782
dec eax
sub ecx, dword [0x4494b4]
add ebx, esp
call fcn.0040dcf0
sub esi, esp
add dword [0x456640], 0x10ca3a9
add ebx, dword [0x44991e]
xor esi, eax
xchg eax, edx
xor dword [0x4569b0], 0x9d39988
call fcn.00407e54
call fcn.00401889
xor dword [0x456a4d], 0x11622d4d
push 0x6e0072
or dword [0x456aa4], 0x253fcf8
sub ecx, dword [str.s:IDS_UNKNOWNMETHOD]
xchg esi, edx
dec esi
call fcn.00407f5e
mov dword [0x456995], ecx
sub edx, dword [0x4492c1]
rol esi, 0x1f
add eax, edi
inc eax
sub dword [0x4566c2], ebx
add esi, edx
sub ecx, dword [0x4494ad]
xchg edi, eax
rol esi, 0x12
mov dword [0x456ab4], 0x22ad799
dec ecx
add esi, 0xfe267c8
not edx
or dword [0x456650], 0x19c56270
xor dword [0x45698c], ecx
call fcn.0040238a
xor dword [0x456673], 0x1473654c
push 0x65006b
xor dword [0x456a6a], 0x4996cc0
Function at 0x42807b
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub dword [0x4499a8], ecx
shr edi, 7
xchg esi, eax
dec eax
mov dword [vtable.type_info.0], 0x2a5e704
xchg ebx, eax
xchg eax, esi
inc edi
ror edx, 9
dec eax
loop 0x428018
rol eax, 0xc
test eax, esi
jo 0x42804e
or esi, edi
mov edx, esi
ror esi, 0x18
xor edi, eax
neg esi
call fcn.00408fb6
ror esi, 0x15
mov ecx, 0x30cd306
rol esi, 5
mov dword [0x449818], 0x16aa9ff4
neg edx
inc esi
mov dword [0x4496bc], 0x7451c97
neg esi
xchg esi, esi
sub dword [0x449a4e], ecx
dec esi
lcall 0xfde3, 0x24e80044
inc ecx
jmp 0x428088
not edx
xor dword [0x449c8c], 0x91574b8
xor ebx, dword [0x449aff]
inc eax
loop 0x42805b
mov ecx, 0x1f134174
xor dword [0x4497bb], ebx
inc eax
not eax
xchg eax, esi
shr eax, 0x1b
ror eax, 0x14
neg esi
test edi, ebp
jo 0x42803a
inc edx
loop 0x4280a1
call fcn.004034ac
test eax, eax
jb 0x4280d3
xchg esi, esi
add esi, eax
or esi, edi
and edi, 0x277edd4
ror esi, 0x1b
add esi, 0x81335eb
xor edi, eax
not eax
xor ebx, dword [0x44915a]
shr edi, 5
or esi, edi
call fcn.00410834
xor edx, ecx
inc edx
xor edx, edx
mov edx, eax
xor esi, eax
push 0
inc eax
rol eax, 0x15
sub ebx, dword [0x449676]
mov dword [0x4566f4], 0x27c42bb0
call fcn.00405d1d
xor eax, eax
rol esi, 0x14
xor ecx, dword [0x449888]
not eax
xor dword [0x456705], 0x28be3685
add ebx, dword [0x4497ec]
rol eax, 0x1e
xor edi, dword [0x44918a]
not ecx
dec esi
mov dword [0x456874], esi
mov dword [0x456648], 0x6188039
sub esi, eax
add esi, 0x1802f2c0
call fcn.00410834
mov dword [0x4565ec], ecx
neg esi
call fcn.004080b6
xor dword [0x456903], ecx
mov dword [0x4568c2], 0x1964aeeb
call fcn.00404280
push 0x320033
rol esi, 7
inc esi
add esi, 0x22e26250
call fcn.004088f0
xor esi, eax
dec esi
xor ebx, dword [0x449986]
ror eax, 0x1a
inc ecx
xor dword [0x456995], 0x3f9ce82
mov dword [0x4569f2], esi
inc eax
ror esi, 0xa
dec esi
xor dword [0x456686], esi
mov dword [0x456898], esi
mov dword [0x456854], 0x1f57d270
mov dword [0x456622], edi
sub dword [0x4566a8], edi
mov dword [0x456941], esi
mov dword [0x45678a], 0x27c19e0
call fcn.004028c9
push 0x6c0065
dec esi
xor dword [0x456a24], 0x4a9115f
xchg esi, eax
call fcn.00406782
dec eax
sub ecx, dword [0x4494b4]
add ebx, esp
call fcn.0040dcf0
sub esi, esp
add dword [0x456640], 0x10ca3a9
add ebx, dword [0x44991e]
xor esi, eax
xchg eax, edx
xor dword [0x4569b0], 0x9d39988
call fcn.00407e54
call fcn.00401889
xor dword [0x456a4d], 0x11622d4d
push 0x6e0072
or dword [0x456aa4], 0x253fcf8
sub ecx, dword [str.s:IDS_UNKNOWNMETHOD]
xchg esi, edx
dec esi
call fcn.00407f5e
mov dword [0x456995], ecx
sub edx, dword [0x4492c1]
rol esi, 0x1f
add eax, edi
inc eax
sub dword [0x4566c2], ebx
add esi, edx
sub ecx, dword [0x4494ad]
xchg edi, eax
rol esi, 0x12
mov dword [0x456ab4], 0x22ad799
dec ecx
add esi, 0xfe267c8
not edx
or dword [0x456650], 0x19c56270
xor dword [0x45698c], ecx
call fcn.0040238a
xor dword [0x456673], 0x1473654c
push 0x65006b
xor dword [0x456a6a], 0x4996cc0
Function at 0x4282c2
Capabilities:
Hash data using murmur3

Disassembly:
xor edi, ecx
xor ecx, esp
mov dword [0x4568cf], esi
add edi, edi
xor edx, 0xf4443a2
call fcn.0040dcf0
sub edx, dword [0x449ae1]
call fcn.004066a1
add ecx, dword [0x449bc8]
dec ebx
sub edx, eax
xor edi, esp
mov dword [0x4566de], 0x1d09c94
add ecx, 0x15e4ba6
call fcn.004084ab
xor eax, eax
not esi
add edx, eax
dec edx
call fcn.00404280
mov dword [0x4565a0], 0x1a33961c
call fcn.00401dee
call fcn.004070c3
or dword [0x45694a], ecx
xor dword [0x456a04], 0xaa49aa
push esp
sub ebx, edx
not eax
xor edx, dword [0x4493ed]

Function at 0x42833f
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, esp
mov dword [0x456888], 0x7663a6
neg esi
xor edi, dword [0x4497f1]
int1
xchg edi, eax
inc esp
add byte [ebx], al
invalid
xor edi, 0x5a8f4ad
xor ecx, dword [0x4493b9]
mov dword [0x456a16], 0x66ceece
add edx, eax
sal byte [ebx], 1
sbb eax, 0x449d6c
sub ecx, dword [0x44953a]
dec ecx
xor dword [0x456638], 0x1b79acda
or dword [0x4565ea], 0x161be652
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub dword [0x4569b4], ebx
mov dword [0x456952], ebx
Function at 0x4283a0
Capabilities:
Hash data using murmur3

Disassembly:
xor ebx, 0x10de9240
xchg edx, edx
sub ecx, dword [0x456cee]
xor esi, eax
sub esi, dword [0x456ea0]
sub esi, dword [0x456f89]
call fcn.0040611d
xor esi, eax
dec esi
ror eax, 0x1d
call fcn.004073d3
sub ecx, dword [0x456b6f]
mov dword [0x456ab2], edi
ror esi, 0xf
mov dword [0x456a7c], edx
not edi
dec ecx
xor edi, dword [0x456c08]
call fcn.0040622a
xor eax, edi
xor eax, edi
call fcn.00403262
inc ecx
not edi
sub dword [0x4566a1], ecx
rol esi, 0xf
call fcn.00408a58
rol eax, 0x1d
inc esi
xor esi, eax
call fcn.00406920
xor esi, eax
xchg edx, edx
xor ebx, 0x10de9240
mov dword [0x456684], edi
add esp, 0x14
neg esi
xor eax, esi
inc esi
xor edi, edx
or dword [0x4565f7], edi
call fcn.00402fff
mov dword [0x456a88], edx
call fcn.00402688
xor esi, 0x546420
sub esi, 0xb547c9b
rol esi, 0x1d
inc ebx
xor dword [0x456a74], ebx
inc esi
xchg esi, edx
dec edx
mov dword [0x45677c], ecx
xor eax, esp
sub ecx, dword [0x456bbc]
xor esi, eax
rol esi, 0xa
xor edi, eax
xor edi, eax
ror esi, 0xa
xor esi, eax
xor eax, esp
mov dword [0x456a6e], ebx
inc edx
xchg esi, edx
dec esi
mov dword [0x456921], ebx
dec ebx
ror esi, 0x1d
add esi, 0xb547c9b
xor esi, 0x546420
sub dword [0x4569c0], edi
xor edi, edx
dec esi
xor eax, esi
neg esi
push 0
xor esi, dword [0x456fae]
add esi, 0x78e6886
sub ecx, dword [0x456b2a]
xor edi, ebp
mov dword [0x4568ca], esi
sub ebx, dword [0x456bcb]
add edx, eax
call fcn.0040338c
xor dword [0x456924], ebx
call fcn.00407f5e
sub edi, dword [0x456c9a]
xor ebx, esp
sub ebx, dword [0x456c34]
xchg eax, eax
call fcn.00402fff
xor ecx, edi
add esi, esp
call fcn.00405957
call fcn.004080b6
sub esi, esp
xor ecx, edi
xchg eax, eax
xor ebx, esp
or dword [0x4569aa], ecx
call fcn.004063a1
sub edx, eax
or dword [0x45678d], ecx
xor edi, ebp
sub esi, 0x78e6886
push 0x636f6c6c
xor ecx, esp
sub dword [0x4568fc], ecx
neg edi
xor edi, eax
xor esi, 0x988638
sub dword [0x456a14], 0x2e196d
sub esi, dword [0x456cac]
mov dword [0x456622], 0x237cca4
inc bp
add byte [esp + ecx*8 + 0xd2b0237], ah
mov al, byte [0x900456e]
adc eax, 0x45672a