joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8c8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008c81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8c807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c806a
add dl, dl
jne 0x8c8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c80dc
xor eax, eax
add dl, dl
jne 0x8c8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8c817d
add dl, dl
jne 0x8c80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8c80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8c8075
mov eax, 1
add dl, dl
jne 0x8c80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8c80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c80e1
sub eax, ebx
mov ebx, 1
jne 0x8c8128
mov ecx, 1
add dl, dl
jne 0x8c810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x8c813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8c814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8c8136
cmp eax, 0x7d00
jae 0x8c816d
cmp eax, 0x500
jb 0x8c8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c8075
cmp eax, 0x7f
ja 0x8c8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8c8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8c819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8c8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405644
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x405686
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x4056a6
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004099c4
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4058fc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00408844
test esi, esi
jne 0x405932
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004089cc
jmp 0x405950
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004057e0
mov edi, eax
test esi, esi
je 0x405950
cmp dword [ebx], 0
je 0x405950
dec esi
jmp 0x405939
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x407458
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00407918
mov byte [esp], al
cmp byte [esp], 0
jne 0x4075e1
test edi, edi
je 0x4075e1
mov byte [esp + 1], 0
test ebp, ebp
jle 0x407521
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x4074fc
cmp edi, 0xffffffff
je 0x4074bd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4074bd
mov byte [esp], 0
jmp 0x4075e1
cmp dword [esi], 1
jg 0x4074fc
cmp dword [esi], 0
jne 0x4074ee
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x4074ee
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x4075e1
lea eax, [esp + 0xc]
call fcn.00407138
dec ebp
test ebp, ebp
jg 0x4074a2
cmp edi, 0xffffffff
je 0x407521
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40751f
mov byte [esp], 0
jmp 0x4075e1
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x407466
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x407521
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040765c
mov edx, eax
mov ebx, dword [0x8048fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x407585
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x407583
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x407585
xor edi, edi
cmp byte [esp], 0
je 0x4075ab
mov ebx, dword [esi]
test bl, 1
jne 0x4075c1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40758b
mov byte [esp + 1], 1
jmp 0x4075c1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4075ab
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x407538
cmp byte [esp], 0
je 0x4075e1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4084a0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x80405c], 0
je 0x408507
cmp word [0x804348], 0xd7b2
jne 0x4084c9
cmp dword [0x804350], 0
jbe 0x4084c9
mov eax, 0x804344
call dword [0x804360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x408534
call fcn.00409304
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x7f5034], 0
jne 0x408523
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret
Function at 0x408704
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x7f5038], 0
je 0x40872f
mov edx, edi
mov eax, esi
call dword [0x7f5038]
mov ebx, eax
jmp 0x408740
mov eax, 8
call fcn.004054a0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x80405d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x4086cc
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x408770
mov eax, ebx
call fcn.004054bc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x40bfb8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x40c11d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00408844
cmp si, word [0x7f5a18]
jb 0x40c050
cmp si, word [0x7f5c18]
ja 0x40c050
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x40c050
mov ebx, edi
add ebx, dword [ebp - 8]
shr ebx, 1
cmp si, word [ebx*8 + 0x7f5a18]
jae 0x40c02a
mov edi, ebx
dec edi
jmp 0x40c04b
cmp si, word [ebx*8 + 0x7f5a18]
jbe 0x40c03a
inc ebx
mov dword [ebp - 8], ebx
jmp 0x40c04b
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x7f5a1c]
call fcn.0040bed8
jmp 0x40c050
cmp edi, dword [ebp - 8]
jae 0x40c014
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x40c0ff
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c0ff
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004099c4
push dword [ebp - 0x160]
push 0x40c138
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.004099c4
push dword [ebp - 0x164]
push 0x40c148
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.004099c4
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00409bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c124
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004088a4
ret
Function at 0x40c2d0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c3d4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x806c14
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x806c2c]
jne 0x40c31c
mov eax, esi
mov edx, 0x806c2e
mov ecx, 0x55
call fcn.004099c4
push 0x806c14
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x40c3be
push 0x806c14
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00408844
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x40c38b
cmp byte [0x806c10], 0
je 0x40c350
mov edx, esi
mov eax, ebx
call fcn.0040c1b4
jmp 0x40c38b
mov edx, esi
mov eax, ebx
call fcn.0040bfb8
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x40c38b
cmp dword [esi], 0
je 0x40c374
mov eax, esi
mov edx, 0x40c3ec
call fcn.00409b1c
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.0040bfb8
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00409b1c
push 0x806c14
call sub.kernel32.dll_EnterCriticalSection
mov word [0x806c2c], bx
mov eax, dword [esi]
call fcn.0040990c
mov ecx, eax
mov eax, 0x806c2e
mov edx, 0xaa
call fcn.0040be38
push 0x806c14
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c3db
lea eax, [ebp - 4]
call fcn.00408844
ret
Function at 0x40c604
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408928
xor eax, eax
push ebp
push 0x40c829
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x40c644
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x40c65e
mov eax, dword [ebp - 4]
call fcn.0040990c
mov ecx, eax
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040be38
cmp word [ebp - 0x21a], 0
je 0x40c813
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c838
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c72d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c838
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c72d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c874
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c72d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c874
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c72d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c8a8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x40c72d
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x40c8dc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40c813
xor eax, eax
push ebp
push 0x40c80c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040c414
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c79c
mov eax, dword [ebp - 0x10]
call fcn.004054a0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00409970
jmp 0x40c7e7
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x40c91c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x40c7e7
mov eax, dword [ebp - 0x10]
call fcn.004054a0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x40c91c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00409970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c813
cmp dword [ebp - 8], 0
je 0x40c802
mov eax, dword [ebp - 8]
call fcn.004054bc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c830
lea eax, [ebp - 4]
call fcn.00408844
ret
Function at 0x40cb30
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00408928
xor eax, eax
push ebp
push 0x40cbf0
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004099c4
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00409b74
mov eax, dword [ebx]
call fcn.0040c9e0
test al, al
jne 0x40cbcd
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.004099c4
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00409b74
mov eax, dword [ebx]
call fcn.0040c9e0
test al, al
jne 0x40cbcd
mov eax, ebx
call fcn.00408844
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cbf7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004088a4
lea eax, [ebp - 4]
call fcn.00408844
ret

Function at 0x40e6d4
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x4128e8
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
or eax, edi
dec ebx
xor eax, 0x4a621ff4
dec edx
mov ecx, edx
xor eax, ebp
shl edi, 0xb

Function at 0x412900
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub edx, 0xdfc86e4c
call fcn.00607177
and edi, dword [0x7fa9e9]
sub edi, 0x79edd70
dec ebx
sub esi, esp
neg eax
shr esi, 0x17
cmp dword [0x801fb9], ebp
jne 0x412929
invalid

Function at 0x412940
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov bh, 0x78
std
js 0x41293f
mov eax, dword [0x3302cbc1]
fucomp st(0)
call fcn.0048eaf0
add edi, dword [0x7fd7c5]
xlatb
jg 0x412953

Function at 0x412948
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov bh, 0x78
std
js 0x41293f
mov eax, dword [0x3302cbc1]
fucomp st(0)
call fcn.0048eaf0
add edi, dword [0x7fd7c5]
xlatb
jg 0x412953

Function at 0x412950
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov bh, 0x78
std
js 0x41293f
mov eax, dword [0x3302cbc1]
fucomp st(0)
call fcn.0048eaf0
add edi, dword [0x7fd7c5]
xlatb
jg 0x412953

Function at 0x412980
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov ecx, eax
ret

Function at 0x412a18
Capabilities:
Hash data using murmur3

Disassembly:
not ebx
call fcn.004288bc
rol eax, 7
rol byte [edi], 0x33
sbb eax, 0x803f91

Function at 0x412a28
Capabilities:
Hash data using murmur3

Disassembly:
xor edx, ebx
rol esi, 0x1d
mov dword [0x8034c7], 0x7d60446f
xor al, 0x80
add byte [edi + 0x44], ch
pushal
jge 0x4129f9

Function at 0x412a58
Capabilities:
Hash data using murmur3

Disassembly:
rol dword [esi - 0x3f], cl
ret
Function at 0x412a60
Capabilities:
Hash data using murmur3

Disassembly:
sub ebx, edx
or dword [0x8034db], 0xdceca5fe
movsd dword es:[edi], dword [esi]
in al, dx
fadd qword [ebx]
fiadd dword [ecx - 0x2d3cb63e]
dec ecx
ret
rcr ch, cl
rol edx, 0xe
call fcn.00471f8d
adc ebp, esi
add eax, 0x1c78700
sbb eax, 0x803442
inc edx
xor al, 0x80
invalid

Function at 0x412a70
Capabilities:
Hash data using murmur3

Disassembly:
dec ecx
ret

Function at 0x412a78
Capabilities:
Hash data using murmur3

Disassembly:
adc ebp, esi
add eax, 0x1c78700
sbb eax, 0x803442
inc edx
xor al, 0x80
invalid
invalid
invalid
sbb al, 0x38

Function at 0x412a80
Capabilities:
Hash data using murmur3

Disassembly:
inc edx
xor al, 0x80
add byte [ecx - 0x7fc7e3fb], al
add byte [eax], 0x84
cmp ah, dl
invalid
inc esi
invalid

Function at 0x412a88
Capabilities:
Hash data using murmur3

Disassembly:
inc edx
xor al, 0x80
add byte [ecx - 0x7fc7e3fb], al
add byte [eax], 0x84
cmp ah, dl
invalid
inc esi
invalid

Function at 0x412ac8
Capabilities:
Hash data using murmur3

Disassembly:
adc edi, dword [edi]
add byte [eax], 0xc1
ret

Function at 0x412ae0
Capabilities:
Hash data using murmur3

Disassembly:
cmp byte [edi + 0x531531d6], al
cmp dword [eax + 0x2e150900], eax
add byte [ecx], cl
adc eax, 0x80362e
invalid

Function at 0x412af0
Capabilities:
Hash data using murmur3

Disassembly:
add byte [ecx], cl
adc eax, 0x80362e
xor ebx, dword [0x803cee]

Function at 0x412b30
Capabilities:
Hash data using murmur3

Disassembly:
ror byte [ecx + esi], 0x3d
lcall 0x983d, 0x21008036
and dword [0x803498], edi
xchg esi, edx
or dword [0x80382d], 0xa03a811
not esi
ror ebx, 0x1c
dec esi

Function at 0x412b50
Capabilities:
Hash data using murmur3

Disassembly:
ror edi, 0x19
dec eax
push edx
neg esi
inc ecx
or dword [0x8037be], 0xac6a3c1
xor edx, ebx
invalid
invalid
invalid
invalid

Function at 0x412bb0
Capabilities:
Hash data using murmur3

Disassembly:
xchg eax, esi
dec ebx
rol edi, 0x1c
dec ebx
not esi
salc
xor ecx, edx
invalid
invalid
invalid
invalid
invalid

Function at 0x412bd8
Capabilities:
Hash data using murmur3

Disassembly:
mov dword [0xcfc1d033], eax
sbb edi, esi
fimul dword [ebx]
or edi, dword [0x803bdd]

Function at 0x412c00
Capabilities:
Hash data using murmur3

Disassembly:
test eax, 0xc1e51fde
enter 0x4e1f, 0xfffffffffffffff7
neg edx
xchg edx, esi
or dword [0x8036ef], esi
add byte [eax], 0x33

Function at 0x412c28
Capabilities:
Hash data using murmur3

Disassembly:
inc esi
rol eax, 0x1f
invalid
ret
invalid
invalid

Function at 0x412c30
Capabilities:
Hash data using murmur3

Disassembly:
pop ds
in eax, 0xc1
ret

Function at 0x412c70
Capabilities:
Hash data using murmur3

Disassembly:
neg esi
dec edi
xor ebx, ecx
inc esi
add esi, 0xc9928aef
out dx, eax
mov dl, byte [edx + 0x323521c9]
cmp byte [eax - 0x3e0f7900], al
add byte [eax], 0x87
invalid
rol ecx, 0xe
invalid

Function at 0x412c90
Capabilities:
Hash data using murmur3

Disassembly:
add byte ds:[eax], 0x81
jmp 0x1d12babe
invalid
Function at 0x412d38
Capabilities:
Hash data using murmur3

Disassembly:
faddp st(7)
add eax, 0x80366a
sub eax, 0xe8e12101
add dword [ecx], esp
loope 0x412d2c
in al, 0x3b
daa
add byte [edi + 0x94843d7], al
xchg edi, edx
inc ebx
dec eax
invalid
invalid
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x412d40
Capabilities:
Hash data using murmur3

Disassembly:
faddp st(7)
add eax, 0x80366a
sub eax, 0xe8e12101
add dword [ecx], esp
loope 0x412d2c
in al, 0x3b
daa
add byte [edi + 0x94843d7], al
xchg edi, edx
inc ebx
dec eax
invalid
invalid
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x412d48
Capabilities:
Hash data using murmur3

Disassembly:
faddp st(7)
add eax, 0x80366a
sub eax, 0xe8e12101
add dword [ecx], esp
loope 0x412d2c
in al, 0x3b
daa
add byte [edi + 0x94843d7], al
xchg edi, edx
inc ebx
dec eax
invalid
invalid
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x412d68
Capabilities:
Hash data using murmur3

Disassembly:
cmp eax, 0xc2c10080
or al, 0xf7
sal dword [ebx], 1
xor esi, esp

Function at 0x412db8
Capabilities:
Hash data using murmur3

Disassembly:
jl 0x412df5
add byte [eax], 0x33
ror dword [ebx], 1
or eax, 0x803eff
invalid
invalid
invalid
neg eax
invalid
iretd

Function at 0x4138d4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.004138c0
add esp, 0x208
pop ebx
ret

Function at 0x420488
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4204e1
test eax, edx
je 0x4204e4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42049f
movzx eax, word [eax]
sub eax, ecx
jmp 0x4204c6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4204c7
add ecx, 4
js 0x4204b7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4204c4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4204c6
xor eax, eax
ret
test eax, eax
je 0x4204f0
test edx, edx
jne 0x420490
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x421b08
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x421b35
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x421c08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.0040990c
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x421c72
test ah, 4
je 0x421c6b
test bl, bl
jne 0x421c30
mov al, 1
jmp 0x421c99
test al, 0x10
je 0x421c38
xor eax, eax
jmp 0x421c99
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x421c5c
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x421c99
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x421c99
test al, 0x10
sete al
jmp 0x421c99
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 2
je 0x421c93
cmp ebx, 3
je 0x421c93
cmp ebx, 0x7b
je 0x421c93
mov eax, esi
call fcn.00421bc8
test al, al
jne 0x421c97
xor eax, eax
jmp 0x421c99
mov al, 1
pop edi
pop esi
pop ebx
ret

Function at 0x421eac
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.0040990c
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x421f01
call sub.kernel32.dll_GetLastError
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x421efb
test ah, 4
je 0x421efb
test al, 0x10
je 0x421efb
mov eax, esi
call fcn.0040990c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x421f01
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret