joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eeb74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
mov ebx, eax
push esi
push edi
mov esi, ecx
mov eax, esi
test eax, eax
je 0x4eeb8d
mov eax, dword [esi - 4]
push eax
push esi
mov esi, edx
mov ecx, esi
test ecx, ecx
je 0x4eeb9a
mov ecx, dword [esi - 4]
add al, cl
inc eax
lea edi, [ebp - 0x100]
mov edx, eax
stosb byte es:[edi], al
mov al, cl
stosb byte es:[edi], al
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
std
dec edi
mov esi, edi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4eebb8
cld
pop edi
pop esi
movzx ecx, byte [ebp - 0x100]
inc ecx
lea edx, [ebp - 0x100]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x10]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eebdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
push esi
push edi
mov dword [ebp - 0x184], ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0x80]
mov ecx, 1
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
movzx ecx, byte [ebp - 0x80]
lea edx, [ebp - 0x7f]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0xc]
push esi
push edi
xor eax, eax
lea esi, [ebp - 0x80]
lodsb al, byte [esi]
push esi
push eax
mov ecx, eax
mov edx, eax
mov edi, esi
xor dl, 0xeb
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
loop 0x4eec22
pop eax
pop esi
lea edi, [ebp - 0x100]
mov cl, byte [esi]
inc ecx
sub eax, ecx
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x180]
stosb byte es:[edi], al
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, esi
lea edx, [ebp - 0x100]
call fcn.004054d0
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.004054d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f4918
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4f4946
mov eax, ebx
call fcn.004f53cc
cmp dword [ebx + 0x40], 0
je 0x4f493f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4f49b7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4f49a9
cmp dword [ebx + 8], 0
je 0x4f4968
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4f497a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4f49a9
cmp dword [ebx + 8], 0
je 0x4f495b
cmp eax, 3
je 0x4f498d
dec eax
jne 0x4f495b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4f495b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4f495b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4f49d5
cmp dword [ebx + 0x14], 0xcc
je 0x4f49d5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004f49e0
pop ebx
ret
Function at 0x52ace0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x52ace8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x52af0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x417e90]
call fcn.00404338
mov edx, dword [0x5428e4]
mov dword [edx], eax
mov eax, dword [0x5428e4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 8]
mov dl, 1
mov eax, dword [0x4184fc]
call fcn.00404338
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x52aece
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x6c]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x52aeb8
inc ebx
xor esi, esi
lea ecx, [ebp - 4]
mov edx, esi
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
cmp dword [ebp - 4], 0
je 0x52aeb0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x3b
je 0x52aeb0
push 1
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00505108
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00505108
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00505108
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00505108
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
call fcn.00405304
push 1
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 9
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00505108
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 4]
call fcn.00405304
cmp dword [ebp - 8], 0
je 0x52aeb0
cmp dword [ebp - 0xc], 0
je 0x52aeb0
cmp dword [ebp - 0x14], 0
je 0x52aeb0
mov edx, dword [0x4c619c]
mov eax, 0x14
call fcn.0040629c
mov edi, eax
mov eax, dword [ebp - 8]
call fcn.00409ff0
mov dword [edi], eax
lea eax, [edi + 4]
mov edx, dword [ebp - 0xc]
call fcn.004052c0
lea eax, [edi + 8]
mov edx, dword [ebp - 0x10]
call fcn.004052c0
lea eax, [edi + 0xc]
mov edx, dword [ebp - 0x14]
call fcn.004052c0
lea eax, [edi + 0x10]
mov edx, dword [ebp - 0x18]
call fcn.004052c0
mov eax, dword [0x5428e4]
mov eax, dword [eax]
mov edx, edi
call fcn.0041a534
inc esi
dec ebx
jne 0x52ad62
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52aed5
mov eax, dword [ebp - 0x20]
call fcn.00404368
ret
Function at 0x8301b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00830308
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x8301de
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8301ca
add dl, dl
jne 0x8301e9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x83023c
xor eax, eax
add dl, dl
jne 0x8301f6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8302dd
add dl, dl
jne 0x830205
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x830210
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x83021b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x830226
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x830232
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x8301d5
mov eax, 1
add dl, dl
jne 0x83024a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x830255
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x830241
sub eax, ebx
mov ebx, 1
jne 0x830288
mov ecx, 1
add dl, dl
jne 0x83026e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x830279
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x830265
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8301d5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x83029f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8302aa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x830296
cmp eax, 0x7d00
jae 0x8302cd
cmp eax, 0x500
jb 0x8302c8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8301d5
cmp eax, 0x7f
ja 0x8302d0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8301d5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x8302fe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x8301d5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000ed1f
pop dword [ebp - 0x2c]
mov eax, 0x1000ed1f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x7b859ee0
sub dword [ebp - 0x3c], 0x2d335995
mov dword [ebp - 0x38], 0x2d6e12fc
sub dword [ebp - 0x38], 0xfb3ac6b7
mov dword [ebp - 0x34], 0x62959f8d
sub dword [ebp - 0x34], 0x16495b5f
mov dword [ebp - 0x30], 0x4a7c7a3d
add dword [ebp - 0x30], 0xb58385c3
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x6f897c92
sub eax, 0x5f87cc82
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x8b96077a
sub dword [ebp - 0x3c], 0x17239e24
mov dword [ebp - 0x38], 0x2681a953
sub dword [ebp - 0x38], 0xe51547de
mov dword [ebp - 0x34], 0x39d9f2d
sub dword [ebp - 0x34], 0xa02e32c1
mov dword [ebp - 0x30], 0x3e1abc1
sub dword [ebp - 0x30], 0x3e1abc1
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x9aa48c80
sub eax, 0x8aa2dc6c
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a7cf
push 0
call eax
mov ecx, 0x387d
xor esi, esi
add esi, eax
mov edi, 0xf658b457
sub edi, 0xe6560457
add edi, dword [ebp - 0x2c]
mov ebx, 0xf31919f3
add ebx, 0xbad66f6
add dword [ebp - 8], ebx
mov edx, dword [edi]
xor edx, ebx
mov dword [esi], edx
add dword [ebp - 0x10], 0x9b11e841
add esi, 0x265c9760
add esi, 0xd9a368a4
add edi, 0x84e8f4b7
sub edi, 0x84e8f4b3
loop 0x1000ee38
add eax, 0xd4c7
xor ebx, ebx
add ebx, eax
add eax, 0xd04db00e
add eax, 0x2fb24ff7
mov ecx, 0xf85603ba
sub ecx, 0xe85603ba
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x402f07
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f31
add eax, dword [0x433c18]
push edi
push edi
push eax
push dword [0x40a014]
mov dword [0x41f97c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402d89
cmp eax, edi
jl 0x40302a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
cmp dword [ebp - 4], esi
jne 0x403026
push dword [ebp + 8]
add dword [0x41f97c], esi
call fcn.00402d89
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403029
cmp dword [ebp + 0x10], edi
jne 0x402ff5
cmp dword [ebp + 8], edi
jle 0x403021
mov esi, 0x41f980
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fa5
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
cmp edi, dword [ebp - 4]
jne 0x403026
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402ff1
cmp dword [ebp + 0x14], edi
jne 0x402ff1
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41f97c], eax
cmp dword [ebp + 8], 0
jg 0x402f98
jmp 0x403021
push 0xfffffffffffffffe
jmp 0x403028
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403000
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x403026
mov eax, dword [ebp - 4]
add dword [0x41f97c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403029
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x405697
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x405d7f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
inc dword [eax]
jne 0x405854
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov eax, 0xf88985c6
invalid
inc ecx
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
Function at 0x40639b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00405efc
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x4063d0
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x433c88], eax
jmp 0x406561
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x4063eb
test eax, eax
je 0x40650c
test cl, 2
je 0x40650c
push edi
push ebx
mov esi, 0x42e360
push esi
call fcn.0040593e
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40640e
push str..
push esi
call edi
jmp 0x406414
push ebx
call fcn.00405ed5
cmp byte [ebx], 0
jne 0x406422
cmp byte [0x42e360], 0x5c
jne 0x40642a
push 0x4082a8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebx + eax]
lea eax, [ebp - 0x148]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x406501
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.0040567b
cmp byte [eax], 0
je 0x40646c
cmp byte [ebp - 0x18], 0
je 0x40646c
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x406482
mov al, byte [esi + 1]
test al, al
je 0x4064e0
cmp al, 0x2e
jne 0x406482
cmp byte [esi + 2], 0
je 0x4064e0
push esi
push edi
call fcn.0040593e
test byte [ebp - 0x148], 0x10
je 0x4064a7
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4064e0
push dword [ebp + 0xc]
push ebx
call fcn.0040639b
jmp 0x4064e0
push ebx
call fcn.00405790
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4064d8
test byte [ebp + 0xc], 4
je 0x4064d0
push ebx
push 0xfffffffffffffff1
call fcn.00404975
push 0
push ebx
call fcn.00406368
jmp 0x4064e0
inc dword [0x433c88]
jmp 0x4064e0
push ebx
push 0xfffffffffffffff2
call fcn.00404975
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40644e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x40650b
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406560
cmp dword [ebp - 8], esi
je 0x406550
push ebx
call fcn.00405a08
test eax, eax
je 0x406560
push ebx
call fcn.00405ea8
push ebx
call fcn.00405790
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x406558
test byte [ebp + 0xc], 4
je 0x406550
push ebx
push 0xfffffffffffffff1
call fcn.00404975
push esi
push ebx
call fcn.00406368
jmp 0x406560
inc dword [0x433c88]
jmp 0x406560
push ebx
push 0xffffffffffffffe5
call fcn.00404975
pop esi
pop ebx
leave
ret 8
Function at 0x441e92
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.00441e3b
test eax, eax
je 0x441feb
lea ecx, [esp + 0x18]
call fcn.00441e3b
lea ecx, [esp + 0x18]
test eax, eax
je 0x441f5a
call fcn.00441e3b
test eax, eax
je 0x441f1c
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.00441e3b
lea edi, [eax + edi*2]
dec ebx
jne 0x441ef2
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x441f13
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x441f16
mov byte [edx], 0
inc edx
jmp 0x441ffd
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x441f52
test ecx, ecx
je 0x441fe6
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x441f44
jmp 0x441fe2
xor ebp, ebp
inc ebp
jmp 0x441fe6
call fcn.00441e71
test edi, edi
jne 0x441f8f
cmp eax, 2
jne 0x441f8a
lea ecx, [esp + 0x18]
call fcn.00441e71
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x441fe6
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x441f7f
jmp 0x441fe2
sub eax, 3
jmp 0x441f92
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
jmp section..htext
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x442003
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x441ec2
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x442188
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x4421ba
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x44219b
jmp 0x4421be
mov eax, dword [esp + 0x10]
test edi, edi
je 0x4421c8
xor byte [esi], al
inc esi
dec edi
jne 0x4421c2
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x10004580
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.1000b000
push 0x288
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x100045b2
push 0x288
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x100045b4
xor esi, esi
mov edi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 0x288
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
cmp eax, 0x6f
jne 0x100045eb
push esi
call ebx
mov ecx, dword [ebp - 4]
push ecx
call fcn.1003433c
add esp, 8
lea edx, [ebp - 4]
mov esi, eax
push edx
push esi
call edi
xor ecx, ecx
test eax, eax
jne 0x10004664
mov eax, esi
test esi, esi
je 0x10004664
mov edx, 6
lea esp, [esp]
cmp dword [eax + 0x190], edx
jne 0x1000460e
cmp ecx, 1
je 0x10004621
inc ecx
mov eax, dword [eax]
test eax, eax
jne 0x10004600
push esi
call ebx
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 0x199]
movzx edx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push edx
movzx edx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
push edx
movzx edx, byte [eax + 0x194]
push ecx
push edx
push str._.2X__.2X__.2X__.2X__.2X__.2X
push 0x1015ebfc
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x20
push esi
call ebx
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009110
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10009120
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000912c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10009136
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10009140
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000914a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10009154
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000915e
or eax, 2
test cl, 2
je 0x10009166
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10009220
test al, 1
je 0x1000922d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10009220
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10009114
pop edi
pop ebx
ret

Function at 0x10009250
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10040aac
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10009282
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x100092b0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10009313
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100092f9
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x100092d8
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x100092d0
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bb30
Capabilities:
Create thread

Disassembly:
push ecx
mov edx, 0x10040558
mov ecx, 0x1015d3e0
jmp 0x1000bb40
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000bb60
test al, al
je 0x1000bb5c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000bb60
add ecx, 2
add edx, 2
test al, al
jne 0x1000bb40
xor eax, eax
jmp 0x1000bb65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000bb6e
call fcn.1000b9c0
push 0
push 0
push 0
push 0x1000b300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1015d47c], 1
jne 0x1000bba6
push 0x10040eec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.PluginRG.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
ret