joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42998b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x429a28
push ebx
push esi
call fcn.00429954
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004298e8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4299d5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x429a27
push edi
push eax
call fcn.00428420
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4299f5
call fcn.0042846e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x429a26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004298e8
add esp, 0x20
test eax, eax
jne 0x429a14
push edi
call fcn.0042846e
jmp 0x429a1c
push ebx
call fcn.0042846e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ac39
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4338b0
push 0x4338a8
push str.FlsAlloc
push 0x1f
call fcn.0042aaf8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ac6d
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
jmp 0x42ac73
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42acb7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4338c0
push 0x4338b8
push str.FlsGetValue
push 0x21
call fcn.0042aaf8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42acee
push dword [ebp + 8]
mov ecx, esi
call dword [0x431144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42acf6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4338c8
push 0x4338c0
push str.FlsSetValue
push 0x22
call fcn.0042aaf8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42ad30
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x431144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x430000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43002d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43002d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69c11633
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4bd80313
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0xbda924
Capabilities:
Encode data using xor

Disassembly:
jmp 0xbda92e
pushal
call 0xbda934
pop ebp
sub ebp, 0x10
sub ebp, 0x7da924
jmp 0xbda94a
mov eax, 0x7da924
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fe
mov edx, 0xb221bb46
xor byte [eax], dl
inc eax
dec ecx
jne 0xbda961
jmp 0xbda974
int 0x8b
int 0xcf
jp 0xbda9c0
inc esi
inc esi
mov dword [edi + 0x464646be], 0x42fe8b45
inc esi
inc esi
inc esi
cld
outsb dx, byte [esi]
inc esi
inc esi
inc esi
mov cl, 0xa4
inc ebp
mov cs, ebp
invalid
bound edi, qword [edx - 0x329d9531]
stosb byte es:[edi], al
int 0xc3
dec esi
inc esi
inc esi
inc esi
int 0xd3
dec edx
inc esi
inc esi
inc esi
int 0xcb
push esi
inc esi
inc esi
inc esi
xchg dword [edi - 0x3abb88bc], ebp
test byte [edx + 0xf], al
dec ecx
ret

Function at 0x110c378c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x110c3796
pushal
call 0x110c379c
pop ebp
sub ebp, 0x10
sub ebp, 0x10c378c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x110c37c0
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x110c37c9
mov eax, 0x10c378c
add eax, ebp
add eax, 0x63
mov ecx, 0x5a9
mov edx, 0x521f8e8e
xor byte [eax], dl
inc eax
dec ecx
jne 0x110c37e0
jmp 0x110c37f3
add eax, 0xb2070543
mov cs, word [esi + 0x764f0f8e]
mov cs, word [esi + 0x36438d8e]
or byte [esi - 0x59cb7172], 0x8e
mov cs, word [esi + 0x468d6c79]
add eax, 0x8e8e820f
mov cs, word [ebp - 0x192121b5]
ljmp 0x91a9
Function at 0x403550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x40357a
add eax, dword [0x472e18]
push edi
push edi
push eax
push dword [0x40b014]
mov dword [0x42f1e4], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.004033d2
cmp eax, edi
jl 0x403673
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
cmp dword [ebp - 4], esi
jne 0x40366f
push dword [ebp + 8]
add dword [0x42f1e4], esi
call fcn.004033d2
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403672
cmp dword [ebp + 0x10], edi
jne 0x40363e
cmp dword [ebp + 8], edi
jle 0x40366a
mov esi, 0x42f1e8
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x4035ee
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
cmp edi, dword [ebp - 4]
jne 0x40366f
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40363a
cmp dword [ebp + 0x14], edi
jne 0x40363a
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x42f1e4], eax
cmp dword [ebp + 8], 0
jg 0x4035e1
jmp 0x40366a
push 0xfffffffffffffffe
jmp 0x403671
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403649
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40b014]
call ebx
test eax, eax
je 0x40366f
mov eax, dword [ebp - 4]
add dword [0x42f1e4], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403672
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x405e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
mov byte [ebp - 0x782], 0x2d
mov byte [ebp - 0x781], 0x71
mov byte [ebp - 0x780], 0x3b
mov byte [ebp - 0x77f], 0x33
mov byte [ebp - 0x77e], 0x33
mov byte [ebp - 0x77d], 0x5f
push 0xc
lea eax, [ebp - 0x78c]
push eax
call fcn.00404257
pop ecx
push eax
mov eax, dword [ebp - 0x28]
lea eax, [ebp + eax - 0x12c]
push eax
call fcn.004041b8
add esp, 0xc
invalid
test esp, edx
invalid

Function at 0x406404
Capabilities:
Check for vm using instruction vpcext

Disassembly:
js 0x406422
sbb byte [edx + eax - 0x6a], dh
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00404247
invalid
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.00404247
mov ebp, 0x498a223e
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x406434
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x406434
call fcn.00404247
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x401ca9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401ce8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401ce8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401ce8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401ce8
cmp dword [ecx + 0x74], 0xe
jbe 0x401ce8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x46751768
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x8b230ce
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x103703b
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push 0xc
push 0x1037938
call fcn.010057fb
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
movzx edx, word [ecx]
cmp dx, 0x5a4d
je 0x103706d
cmp dx, 0x4550
jne 0x10370e4
cmp dx, 0x5a4d
jne 0x1037091
mov edx, dword [ecx + 0x3c]
cmp edx, ebx
je 0x10370e4
add edx, ecx
mov dword [eax + 0xc], edx
mov esi, dword [eax + 0x2c]
add esi, ecx
lea edi, [edx + 0xf8]
cmp edi, esi
ja 0x10370e4
add ecx, 0x40
cmp edx, ecx
jae 0x1037094
jmp 0x10370e4
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0x4550
jne 0x10370e4
mov byte [eax + 0x21], bl
cmp word [ecx + 0x14], bx
je 0x10370e4
cmp byte [ecx + 0x1a], 3
jae 0x10370b4
cmp byte [ecx + 0x1b], 5
jb 0x10370e4
lea ecx, [eax + 0x24]
mov dword [eax + 0x28], ecx
mov dword [ecx], ecx
mov ecx, dword [eax + 0xc]
movzx ecx, word [ecx + 6]
mov dword [eax + 0x14], ecx
mov ecx, dword [eax + 0xc]
movzx edx, word [ecx + 0x14]
lea ecx, [edx + ecx + 0x18]
mov dword [eax + 0x18], ecx
mov dword [ebp - 0x1c], 1
jmp 0x10370e4
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.01005840
ret 4
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x401396
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov esi, ecx
cmp dword [0x40b0c4], edx
jne 0x4013d5
push ebx
push edi
push 8
mov ecx, edx
pop edi
mov ebx, ecx
and bl, 1
movzx ebx, bl
neg ebx
sbb ebx, ebx
and ebx, 0xedb88320
shr ecx, 1
xor ecx, ebx
dec edi
jne 0x4013aa
mov dword [edx*4 + 0x40b0c0], ecx
inc edx
cmp edx, 0x100
jl 0x4013a5
pop edi
pop ebx
not esi
jmp 0x4013f3
movzx ecx, byte [eax]
dec dword [esp + 8]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x40b0c0]
inc eax
cmp dword [esp + 8], 0
ja 0x4013d9
mov eax, esi
not eax
pop esi
ret 4
Function at 0x410470
Capabilities:
Get hostname
Get session user name
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x401424]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x401030
push 0x4ef080
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4104bf
push 0x401460
push 0x101
push 0x4ef080
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
push 0x100
push 0x4ef9a0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x4104f6
push 0x401470
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
push 0x401488
push 0x100
push 0x4ef9a0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0x10
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004ed9d4
add esp, 0x194
ret
Function at 0x410520
Capabilities:
Get local ipv4 addresses
Get mac address on windows
Initialize winsock library

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x401424]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
xor ebp, ebp
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
lea eax, [esp + 0x10]
push eax
xor edi, edi
push edi
push edi
push 0x100
push 2
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
call esi
cmp eax, 0x6f
jne 0x410592
push dword [esp + 0x10]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], edi
push eax
push edi
push ebp
push 0x100
push 2
call esi
test eax, eax
jne 0x4106e1
mov ebx, edi
test edi, edi
je 0x4106b1
mov esi, 0x4ef1a0
mov dword [esp + 0x1c], 0x4ef600
mov dword [esp + 0x14], esi
cmp dword [ebx + 0x34], 6
jne 0x4106d6
movzx eax, byte [ebx + 0x31]
push eax
movzx eax, byte [ebx + 0x30]
push eax
movzx eax, byte [ebx + 0x2f]
push eax
movzx eax, byte [ebx + 0x2e]
push eax
movzx eax, byte [ebx + 0x2d]
push eax
movzx eax, byte [ebx + 0x2c]
push eax
push 0x401498
lea eax, [esp + 0x1cc]
push 0x12
push eax
call fcn.00492820
add esp, 0x24
xor edi, edi
test ebp, ebp
jle 0x410649
mov esi, 0x4ef600
nop
lea eax, [esp + 0x1b0]
mov ecx, esi
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x410630
test dl, dl
je 0x41062c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x410630
add ecx, 2
add eax, 2
test dl, dl
jne 0x410610
xor eax, eax
jmp 0x410635
sbb eax, eax
or eax, 1
test eax, eax
je 0x4106d2
inc edi
add esi, 0x12
cmp edi, ebp
jl 0x410600
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x1b0]
push eax
push 0x12
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov eax, dword [ebx + 0x10]
add esp, 0xc
test eax, eax
je 0x41067b
mov eax, dword [eax + 0xc]
push 0x16
push esi
add eax, 4
push eax
push 2
call sub.WS2_32.dll_inet_ntop
jmp 0x41068c
push 0x4014b8
push 0x16
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
add edi, 0x12
add esi, 0x16
inc ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], esi
cmp edi, 0x4ef984
jl 0x4106d6
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x1c4]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ed9d4
add esp, 0x1b8
ret
mov esi, dword [esp + 0x14]
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4105b5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4106b1
jmp 0x4106a7
Function at 0x4a09a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4a0a4f
push esi
call fcn.004b37e0
add esp, 4
test al, al
jne 0x4a0a4f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4a09c7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004bcdc0
add esp, 0xc
test eax, eax
je 0x4a09fb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004bcdc0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4a09fd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x4a0a2e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004b0bd0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x4a0a10
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret