joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406750
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x412018]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x21c], ecx
mov ecx, dword [ebp - 0x21c]
call fcn.004099d0
test eax, eax
je 0x406782
mov eax, 1
jmp 0x406827
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4067a1
xor eax, eax
jmp 0x406827
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push str.RPCSS
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
push 1
push 3
push 0x10
push 0xf01ff
mov edx, dword [ebp - 0x21c]
add edx, 0x230
push edx
mov eax, dword [ebp - 0x21c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40680e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x406827
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00407668
mov esp, ebp
pop ebp
ret

Function at 0x406840
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.004099d0
test eax, eax
jne 0x40685f
mov eax, 1
jmp 0x4068ea
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40687b
xor eax, eax
jmp 0x4068ea
push 0x10020
mov eax, dword [ebp - 0x2c]
add eax, 0x230
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4068aa
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x4068ea
lea eax, [ebp - 0x28]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 8], 0
je 0x4068e8
mov eax, 1
jmp 0x4068ea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x407668
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412018]
jne 0x407672
repz ret
jmp fcn.00407bfa

Function at 0x4080c5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x408100
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4080e7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4080f8
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x408102
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4080dd
xor eax, eax
pop edi
pop esi
ret
Function at 0x4087d0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40875c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40877a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4087d8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4087bf
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4087c8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4087d2
add ecx, eax
or byte [ecx], 4
invalid
invalid
or dword [eax + eax*2], eax
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4087b4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40873e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x408825
dec eax
je 0x40881c
sub eax, 3
je 0x408813
mov dword [ebp - 4], 0x40
jmp 0x408842
mov dword [ebp - 4], 4
jmp 0x408828
mov dword [ebp - 4], 0x20
jmp 0x408828
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x408874
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4087f4
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00408085
aas
fsub st(6), st(0)
mov dword [0x6a1475ff], eax
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x408880
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6c85cc90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6c85cd70
jmp 0x6c85ce3f
jmp 0x6c85cf0e
jmp 0x6c85cfdd
jmp 0x6c85d0ac
jmp 0x6c85d17b
jmp 0x6c85d24a
jmp 0x6c85d319
jmp 0x6c85d3e8
jmp 0x6c85d4b7
jmp 0x6c85d586
jmp 0x6c85d655
jmp 0x6c85d724
jmp 0x6c85d7f3
jmp 0x6c85d8c2
jmp 0x6c85d991
jmp 0x6c85da60
jmp 0x6c85db2f
jmp 0x6c85dbfe
jmp 0x6c85dccd
jmp 0x6c85dd9c
jmp 0x6c85de6b
jmp 0x6c85df3a
jmp 0x6c85e009
jmp 0x6c85e0d8
jmp 0x6c85e1a7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6c85e27c
jmp 0x6c85e34b
jmp 0x6c85e41a
jmp 0x6c85e4e9
jmp 0x6c85e5b8
jmp 0x6c85e687
jmp 0x6c85e756
jmp 0x6c85e825
jmp 0x6c85e8f4
jmp 0x6c85e9c3
jmp 0x6c85ea92
jmp 0x6c85eb61
jmp 0x6c85ec30
jmp 0x6c85ecff
jmp 0x6c85edce
jmp 0x6c85ee9d
jmp 0x6c85ef6c
jmp 0x6c85f03b
jmp 0x6c85f10a
jmp 0x6c85f1d9
jmp 0x6c85f2a8
jmp 0x6c85f377
jmp 0x6c85f446
jmp 0x6c85f515
jmp 0x6c85f5e4
jmp 0x6c85f6b3
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6c85f79c
jmp 0x6c85f86b
jmp 0x6c85f93a
jmp 0x6c85fa09
jmp 0x6c85fad8
jmp 0x6c85fba7
jmp 0x6c85fc76
jmp 0x6c85fd45
jmp 0x6c85fe14
jmp 0x6c85fee3
jmp 0x6c85ffb2
jmp 0x6c860081
jmp 0x6c860150
jmp 0x6c86021f
jmp 0x6c8602ee
jmp 0x6c8603bd
jmp 0x6c86048c
jmp 0x6c86055b
jmp 0x6c86062a
jmp 0x6c8606f9
jmp 0x6c8607c8
jmp 0x6c860897
jmp 0x6c860966
jmp 0x6c860a35
jmp 0x6c860b04
jmp 0x6c860bd3
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6c860cab
jmp 0x6c860d7a
jmp 0x6c860e49
jmp 0x6c860f18
jmp 0x6c860fe7
jmp 0x6c8610b6
jmp 0x6c861185
jmp 0x6c861254
jmp 0x6c861323
jmp 0x6c8613f2
jmp 0x6c8614c1
jmp 0x6c861590
jmp 0x6c86165f
jmp 0x6c86172e
jmp 0x6c8617fd
jmp 0x6c8618cc
jmp 0x6c86199b
jmp 0x6c861a6a
jmp 0x6c861b39
jmp 0x6c861c08
jmp 0x6c861cd7
jmp 0x6c861da6
jmp 0x6c861e75
jmp 0x6c861f44
jmp 0x6c862013
jmp 0x6c8620e2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6c8621ca
jmp 0x6c862299
jmp 0x6c862368
jmp 0x6c862437
jmp 0x6c862506
jmp 0x6c8625d5
jmp 0x6c8626a4
jmp 0x6c862773
jmp 0x6c862842
jmp 0x6c862911
jmp 0x6c8629e0
jmp 0x6c862aaf
jmp 0x6c862b7e
jmp 0x6c862c4d
jmp 0x6c862d1c
jmp 0x6c862deb
jmp 0x6c862eba
jmp 0x6c862f89
jmp 0x6c863058
jmp 0x6c863127
jmp 0x6c8631f6
jmp 0x6c8632c5
jmp 0x6c863394
jmp 0x6c863463
jmp 0x6c863532
Function at 0x6c8998d7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d046018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d046018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6c8999c6
jmp 0x6c899a95
jmp 0x6c899b64
jmp 0x6c899c33
jmp 0x6c899d02
jmp 0x6c899dd1
jmp 0x6c899ea0
jmp 0x6c899f6f
jmp 0x6c89a03e
jmp 0x6c89a10d
jmp 0x6c89a1dc
jmp 0x6c89a2ab
jmp 0x6c89a37a
jmp 0x6c89a449
jmp 0x6c89a518
jmp 0x6c89a5e7
jmp 0x6c89a6b6
jmp 0x6c89a785
jmp 0x6c89a854
jmp 0x6c89a923
jmp 0x6c89a9f2
jmp 0x6c89aac1
jmp 0x6c89ab90
jmp 0x6c89ac5f
jmp 0x6c89ad2e
jmp 0x6c89adfd
mov dword [ebp - 0x14], 0
jmp 0x6c89aed3
jmp 0x6c89afa2
jmp 0x6c89b071
jmp 0x6c89b140
jmp 0x6c89b20f
jmp 0x6c89b2de
jmp 0x6c89b3ad
jmp 0x6c89b47c
jmp 0x6c89b54b
jmp 0x6c89b61a
jmp 0x6c89b6e9
jmp 0x6c89b7b8
jmp 0x6c89b887
jmp 0x6c89b956
jmp 0x6c89ba25
jmp 0x6c89baf4
jmp 0x6c89bbc3
jmp 0x6c89bc92
jmp 0x6c89bd61
jmp 0x6c89be30
jmp 0x6c89beff
jmp 0x6c89bfce
jmp 0x6c89c09d
jmp 0x6c89c16c
jmp 0x6c89c23b
jmp 0x6c89c30a
mov dword [ebp - 0x18], 0
jmp 0x6c89c3e0
jmp 0x6c89c4af
jmp 0x6c89c57e
jmp 0x6c89c64d
jmp 0x6c89c71c
jmp 0x6c89c7eb
jmp 0x6c89c8ba
jmp 0x6c89c989
jmp 0x6c89ca58
jmp 0x6c89cb27
jmp 0x6c89cbf6
jmp 0x6c89ccc5
jmp 0x6c89cd94
jmp 0x6c89ce63
jmp 0x6c89cf32
jmp 0x6c89d001
jmp 0x6c89d0d0
jmp 0x6c89d19f
jmp 0x6c89d26e
jmp 0x6c89d33d
jmp 0x6c89d40c
jmp 0x6c89d4db
jmp 0x6c89d5aa
jmp 0x6c89d679
jmp 0x6c89d748
jmp 0x6c89d817
mov dword [ebp - 0x10], 0
jmp 0x6c89d8ed
jmp 0x6c89d9bc
jmp 0x6c89da8b
jmp 0x6c89db5a
jmp 0x6c89dc29
jmp 0x6c89dcf8
jmp 0x6c89ddc7
jmp 0x6c89de96
jmp 0x6c89df65
jmp 0x6c89e034
jmp 0x6c89e103
jmp 0x6c89e1d2
jmp 0x6c89e2a1
jmp 0x6c89e370
jmp 0x6c89e43f
jmp 0x6c89e50e
jmp 0x6c89e5dd
jmp 0x6c89e6ac
jmp 0x6c89e77b
jmp 0x6c89e84a
jmp 0x6c89e919
jmp 0x6c89e9e8
jmp 0x6c89eab7
jmp 0x6c89eb86
jmp 0x6c89ec55
jmp 0x6c89ed24
mov dword [ebp - 0x10], 0
jmp 0x6c8a5696
jmp 0x6c89edff
jmp 0x6c89eece
jmp 0x6c89ef9d
jmp 0x6c89f06c
jmp 0x6c89f13b
jmp 0x6c89f20a
jmp 0x6c89f2d9
jmp 0x6c89f3a8
jmp 0x6c89f477
jmp 0x6c89f546
jmp 0x6c89f615
jmp 0x6c89f6e4
jmp 0x6c89f7b3
jmp 0x6c89f882
jmp 0x6c89f951
jmp 0x6c89fa20
jmp 0x6c89faef
jmp 0x6c89fbbe
jmp 0x6c89fc8d
jmp 0x6c89fd5c
jmp 0x6c89fe2b
jmp 0x6c89fefa
jmp fcn.6c89ffc9
mov eax, dword [0x6d046018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6c89ed30
nop
leave
ret
Function at 0x40812b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417400]
jne 0x408135
repz ret
jmp fcn.0040deca

Function at 0x40af51
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406450
and dword [ebp - 0x14], 0
cmp dword [0x445c14], 0
mov dword [ebp - 0x18], eax
jne 0x40b004
push 0x402238
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b0ac
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40222c
push ebx
call edi
test eax, eax
je 0x40b0ac
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40221c
push ebx
mov dword [0x445c14], eax
call edi
push eax
call esi
push 0x402208
push ebx
mov dword [0x445c18], eax
call edi
push eax
call esi
push 0x4021ec
push ebx
mov dword [0x445c1c], eax
call edi
push eax
call esi
mov dword [0x445c24], eax
test eax, eax
je 0x40b004
push 0x4021d4
push ebx
call edi
push eax
call esi
mov dword [0x445c20], eax
mov eax, dword [0x445c20]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b05d
cmp dword [0x445c24], ecx
je 0x40b05d
push eax
call esi
push dword [0x445c24]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b05d
test ebx, ebx
je 0x40b05d
call edi
test eax, eax
je 0x40b054
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b054
test byte [ebp - 8], 1
jne 0x40b05d
or dword [ebp + 0x10], 0x200000
jmp 0x40b090
mov eax, dword [0x445c18]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b090
mov eax, dword [0x445c1c]
cmp eax, dword [ebp - 0x18]
je 0x40b090
push eax
call esi
test eax, eax
je 0x40b090
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x445c14]
call esi
test eax, eax
je 0x40b0ac
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b0ae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040812b
leave
ret
Function at 0x4149e0
Capabilities:
Access the windows event log
Connect pipe
Delete directory
Delete file
Get common file path
Get uefi variable
Read pipe
Write pipe

Disassembly:
mov eax, 0x1404
call fcn.0040eda0
cmp dword [0x2b6f774], 0x37
jne 0x414abe
push 0x4035a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
lea eax, [esp + 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x403620
push 0x403660
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0x403574
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
lea eax, [esp + 0x408]
push eax
push 0x403584
push 0x4036c0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea ecx, [esp + 0xc08]
push ecx
push 0x4036dc
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edx, dword [0x2b6fb88]
mov ecx, dword [0x2b6f258]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x1404
ret
Function at 0x402f80
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x4034a0
test edx, edx
je 0x4034a0
call fcn.00402f97
mov eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x40c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040c357

Function at 0x40f640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040f657

Function at 0x411680
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
pop ebp
cmp dword [0x743ed4], 0xdc1e11f2
jle 0x411692

Function at 0x411690
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
and ebx, eax
neg esi
sub eax, 0x4e8efed5
and edi, dword [0x742c76]
xor ecx, edx
cmp eax, 0x13decc11
jnp 0x4116ad
shl ebx, 0x1f
cmp dword [0x745325], ebx
jno 0x4116b7
xor edi, ebp
or ebx, esp
and edx, 0xbbf391d7
xor ebx, 0xb54e664c
shr edi, 0x1d
xor edi, 0x77d75997
call fcn.005405e8
mov ecx, 0x68f707e2
sub ebx, 0x840aa89d
inc edx
and ebx, 0x3b47ac48
xor ebx, dword [0x7420b1]
ror edx, 4
inc edx
call fcn.005bac3a
mov edx, 0x12000a
dec edi
xor edi, 0xb31e1d92
rol eax, 0xf
sub ebx, dword [0x744452]
or esi, 0xd7eef4d1
dec ecx
jne 0x4116d8
add dword [0x75abe3], ecx
or ecx, 0xd86a594a
sub edi, 0x586b35ef
shl edi, 0x1a
not esi
rol edi, 1
ror ecx, 0xd
shr edx, 3
call fcn.00462b27
test edi, 0x77836c3b
jb 0x411743
shl esi, 0x18
or esi, 0xc14828c
mov esi, ebx
and edi, ecx
or edx, edx
and edi, 0x21d06d16
cmp dword [0x74615e], 0x5d8fbada
js 0x411766
call fcn.004ab1b2
mov ecx, 0x41d5e71c
add eax, ecx
test dword [0x7423ef], ebp
je 0x41177b
add esi, 0xd2505ca2
xchg esi, edx
and edi, 0xb344354
mov eax, esi
add edx, edi
cmp ebx, edx
jl 0x411790
call fcn.00540bd0
or ebx, 0x12ba63e6
xchg esi, edx
dec ecx
jne 0x41176b
mov eax, 0x9359a0e4
add esi, eax
neg ecx
call fcn.005b4c10
inc ecx
mov ecx, 0x4c9f699f

Function at 0x411a20
Capabilities:
Hash data using murmur3

Disassembly:
adc dword [eax + 0x72], ecx
aad 0xc1
leave
sbb eax, 0xf6f2f681
insb byte es:[edi], dx
xor byte [eax + 0x49], al
Function at 0x412580
Capabilities:
Hash data using murmur3

Disassembly:
xor edx, 0x4bc00ef1
sub edi, 0x85b8efd1
not edx
rol edx, 0xb
add eax, 0x5e69a429
and dword [0x75abca], ebx
add dword [0x75aa64], edx
xchg esi, eax
not edx
mov dword [0x75aa02], edi
mov dword [0x75aa16], edx
not edx
xchg esi, eax
xor dword [0x75a9e5], ebx
sub eax, 0x5e69a429
ror edx, 0xb
not edx
add edi, 0x85b8efd1
xor edx, 0x4bc00ef1
dec ecx
dec ecx
sub esi, 0x728e1aec
rol ebx, 0xc
mov dword [0x75abb4], ecx
add ecx, 0xa3544fab
call fcn.0048eaf8
ror eax, 0x1e
xor edi, ecx
push edi
xor edi, 0xb6585e03
dec ebx
call fcn.004bdae3
xchg ecx, edx
xor edx, 0x6a69e395
xor ecx, ebp
or eax, dword [0x75afbb]
xor edi, 0x242f020a
inc esi
inc edi
or dword [0x75ac2c], eax
rol edi, 0x1d
inc ecx
add dword [0x75aafa], ecx
sub eax, ecx
mov dword [0x75ab45], edi
add ecx, edi
not eax
dec edx
xor esi, 0x9635509a
inc eax
call fcn.005fe31e
call fcn.0048d26e
dec eax
xor esi, 0x9635509a
inc edx
not eax
sub ecx, edi
add dword [0x75ab9d], esi
add eax, ecx
and dword [0x75ab9d], ecx
dec ecx
ror edi, 0x1d
mov dword [0x75aa48], ecx
dec edi
dec esi
xor edi, 0x242f020a
xor ecx, ebp
xor edx, 0x6a69e395
xchg ecx, edx
call fcn.00432698
inc ebx
xor edi, 0xb6585e03
push esp
add ebx, dword [0x75af92]
dec edx
xor esi, esp
call fcn.005e0082
neg eax
sub esi, esp
not ecx
ror edx, 0x1b
xor edx, 0xbc26ebfb
sub dword [0x75aa18], edx
add edi, dword [0x75aec9]
not edi
call fcn.0053ba9a
add eax, 0xf23f1b17
not edx
call fcn.00504f5a
rol edi, 0x18
call fcn.004e2163
rol ecx, 0x16
xor eax, dword [0x75ae8a]
mov dword [0x75aa07], ebx
sub dword [0x75a9d7], edi
ror ecx, 0x16
call fcn.006213f7
ror edi, 0x18
not edx
sub eax, 0xf23f1b17
call fcn.0065d1c5
not edi
sub dword [0x75ab3e], ebx
xor edx, 0xbc26ebfb
rol edx, 0x1b
not ecx
add esi, esp
neg eax
call fcn.005ba033
xor esi, esp
inc edx
push eax
mov dword [0x75aa3f], edx
add edi, dword [0x75af7e]
or dword [0x75ab10], esi
sub ecx, dword [0x75afae]
dec edi
sub eax, 0x3ebec817
xor eax, dword [0x75ad4a]
sub edi, ecx
dec edi
xor eax, edi
and dword [0x75abcb], 0xd758553
inc eax
or esi, dword [0x75ae35]
add dword [0x75ab16], edx
mov dword [0x75abba], ebx
dec ebx
mov dword [0x75a9e6], edi
call fcn.00579690
call fcn.00556761
inc ebx
or dword [0x75ac84], edi
dec eax
xor eax, edi
inc edi
add edi, ecx
add eax, 0x3ebec817
inc edi
xor dword [0x75ac2d], edx
or dword [0x75aca5], ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
rol ecx, 0x11
call fcn.005b2cd0
ror esi, 0xa
dec esi
xor ebx, dword [0x75af9a]
not ebx
xor eax, ebp
or ebx, dword [0x75ae27]
call fcn.0055a74b
ror ecx, 7
invalid

Function at 0x4127c0
Capabilities:
Hash data using murmur3

Disassembly:
push ss
stosd dword es:[edi], eax
jne 0x41275e
mov esi, 0xc1000cc9
rol dword [edi], 0xe8
loop 0x41275a
and byte [eax], al
Function at 0x435160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, dword [ebp + 0xc]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1e
push 0x6bf6d0
call fcn.004f2450
add esp, 8
cmp eax, 2
jl 0x4351c3
lea esi, [ebp - 0xb0]
mov ecx, esi
push 0xfffffffffffffffe
push 0xb8
push 0x6bf6d0
call fcn.00494bc0
lea eax, [ebp - 0xa8]
push 0x10
push 0x6bf81d
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, esi
call fcn.004950a0
mov ebx, dword [ebp + 8]
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0xb0]
movdqu xmmword [esi], xmm0
push edi
push esi
call fcn.00582670
add esp, 8
cmp byte [esi + 0xc], 1
jne 0x4351f1
push esi
call fcn.0048f560
add esp, 4
test al, al
jne 0x435231
mov dword [ebx], 0
cmp byte [ebp - 0xa4], 1
jne 0x43520b
lea ecx, [ebp - 0xb0]
call fcn.004f2fc0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call fcn.00424180
add esp, 4
jmp 0x4352d2
push 0x2c
call fcn.00540349
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004a1680
test edi, edi
je 0x43524b
inc dword [edi + 4]
push edi
call fcn.0049f1e0
add esp, 4
lea ecx, [ebp - 0xb3]
mov byte [ecx + 2], 9
mov edx, 0x6bf728
lea eax, [ebp - 0xbc]
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x4353a7
mov dword [ebp - 0xb8], 0x65696669
mov dword [ebp - 0xbc], 0x6c617571
mov word [ebp - 0xb4], 0x64
xor edx, edx
mov ecx, edi
push edx
push edx
push eax
call fcn.004a16a0
cmp byte [ebp - 0xb1], 0
jns 0x4352bb
push dword [ebp - 0xbc]
call fcn.00540380
add esp, 4
test edi, edi
je 0x435222
inc dword [edi + 4]
push edi
call fcn.00424180
add esp, 4
inc dword [edi + 4]
mov dword [ebp - 0xc0], 0xffffffff
cmp byte [ebp - 0xa4], 0
je 0x435398
lea ebx, [ebp - 0xc0]
lea edx, [ebp - 0xb0]
mov ecx, ebx
push 0x6bf7d0
push edi
call fcn.00434e40
add esp, 8
mov esi, dword [ebx]
test esi, esi
je 0x435364
cmp byte [ebp - 0xa4], 0
je 0x435398
push 0x30
call fcn.00540349
add esp, 4
mov ebx, eax
mov dword [ebp - 0xbc], esi
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xbc]
mov ecx, ebx
push 1
push edx
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00434120
test ebx, ebx
je 0x435366
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
lock xadd dword [ebx + eax + 8], ecx
cmp ecx, 0x7fffffff
jne 0x435366
jmp 0x4353ae
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
test edi, edi
je 0x4351f7
dec dword [edi + 4]
jne 0x4351f7
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [0x73c768]
mov ecx, edi
push 1
call ebx
mov ebx, dword [ebp + 8]
jmp 0x4351f7
push 0x6bd975
push 0x6bd0bf
call fcn.0057cbd0
push 0x6bd32f
jmp 0x43539d
int3
Function at 0x4706f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa0
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x2d
push 0x6c33b0
call fcn.004f2450
add esp, 8
test eax, eax
jle 0x47074f
lea esi, [ebp - 0xac]
mov ecx, esi
push 0xffffffffffffffff
push 0x274
push 0x6c33b0
call fcn.00494bc0
lea eax, [ebp - 0xa4]
push 0x1a
push 0x6c3c50
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, esi
call fcn.004950a0
push 0x60
call fcn.00540349
add esp, 4
mov esi, eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa4], 0x80000030
mov dword [ebp - 0xa8], 0x2d
add eax, 0x5a
mov ecx, 0x6c1dd2
cmp esi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4707e8
mov edi, dword [ebp + 8]
push 0x5a
push 0x6c1dd2
push esi
call fcn.00543ce0
add esp, 0xc
mov word [esi + 0x5a], 0
lea esi, [ebp - 0xac]
push edi
push 0
push esi
push SysReAllocStringLen
call fcn.0059eb00
add esp, 0x10
mov ebx, eax
cmp byte [esi + 0xb], 0
jns 0x4707d1
push dword [ebp - 0xac]
call fcn.00540380
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6bebbc
push 0x6bd0bf
call fcn.0057cbd0
int3