joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100044f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x10004521
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.100033c0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov esi, dword [ebx + 4]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x1000464a
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [edi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ecx
jb 0x10004576
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ecx + 0x10]
xor edx, edx
mov dword [ebp - 0xc], ecx
mov ebx, 0x811c9dc5
test ecx, ecx
je 0x100045a7
mov eax, dword [ebp - 4]
mov edi, ecx
nop dword [eax]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10004590
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
and ebx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x100045c4
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x10004640
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.100049d0
test al, al
jne 0x100045fe
mov ebx, dword [ebx]
cmp ebx, esi
je 0x100045f6
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x1000463d
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10004620
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.100049d0
test al, al
je 0x10004653
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10004605
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x10004560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x1000463d
Function at 0x10004670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100046a1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100033c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100047ac
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10004732
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1000479f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000476c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10004764
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1000479f
cmp ebx, edx
je 0x1000477c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100047b5
cmp ebx, edx
jne 0x10004770
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x10]
mov eax, ecx
cmp ecx, esi
jne 0x100046e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1000479f
Function at 0x401000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
nop
mov eax, 0x402022
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_fopen
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x401035
mov eax, 0
jmp 0x40112d
mov eax, 2
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
push ecx
mov dword [ebp - 0x10], eax
call sub.msvcrt.dll_ftell
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
cmp ecx, 0
jne 0x401088
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, 0
jmp 0x40112d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
inc ecx
push ecx
call sub.msvcrt.dll_malloc
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0
jne 0x4010b0
mov eax, 0
jmp 0x40112d
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fseek
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [eax]
push ecx
mov eax, 1
push eax
mov eax, dword [ebp - 8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_fclose
add esp, 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [eax]
cmp ecx, edx
je 0x401119
mov eax, dword [ebp - 8]
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, 0
jmp 0x40112d
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 8]
add eax, ecx
mov ecx, 0
mov byte [eax], cl
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4014ac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x4014da
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x4014e2
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x401511
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, 0
mov ecx, dword [ebp - 0x48]
cmp eax, ecx
jne 0x401537
mov eax, 0x402104
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x401560
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x401560
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x401560
mov eax, dword [ebp - 0x48]
add eax, 0xffffffff
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.0040114d
leave
ret
Function at 0x401060
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, ebx
mov eax, ebx
mov eax, esi
mov ebx, ebx
xor ebx, eax
xor esi, ebx
mov ebx, ebx
xor eax, eax
xor eax, esi
not eax
imul eax
neg esi
rol edi, 0xd7
not edi
imul ebx
dec edx
not esi
ror ebx, 9
sbb ebx, 0xc7
rcl edi, 0x64
neg ebx
mov eax, 0xfb
bswap ebx
imul ebx
neg ebx
bswap esi
imul eax
or eax, 0xb8
rcl ebx, 0x75
inc eax
neg edx
not eax
ror eax, 0x7d
ror eax, 0xb1
sbb edx, 0x71
rcr edi, 0x58
bswap edx
bswap esi
bswap esi
rcl esi, 0xe6
bswap edx
not eax
ror edx, 0x5c
sbb esi, 0xe2
sbb edx, 0x68
not esi
rol esi, 0x7f
mov edi, 0x66
dec edx
bswap eax
ror eax, 0x39
dec eax
bswap esi
and esi, 0x3a
imul esi
sub ebx, 0xe7
neg eax
sub edi, 0x82
bswap edi
xor ecx, ecx
xor edi, edi
mov esi, eax
xor esi, esi
mov ebx, ebx
mov ebx, ebx
mov esi, ebx
mov eax, eax
bswap edx
imul ebx
dec edi
neg eax
inc eax
not esi
bswap ebx
dec edx
dec edx
or edx, 0xe
bswap edi
neg ebx
sub edx, 0xcd
rcr eax, 0xbe
rcr edi, 0x7f
inc ebx
mov eax, 0x20
sbb eax, 0xac
add eax, 0x9a
inc esi
bswap esi
neg edx
dec edi
inc ebx
not edx
not esi
imul edx
not edx
neg eax
inc eax
rcl edx, 0xab
ror eax, 0xad
bswap ebx
bswap edx
rcl ebx, 0xbb
imul edi
not edi
inc eax
add eax, 0xd0
dec edi
bswap eax
sub edx, 0x25
and edx, 0x36
imul eax
or ebx, 0xae
add edx, 0x98
neg ebx
not eax
inc edi
dec ebx
mov eax, ebx
xor ebx, ebx
mov ebx, ebx
mov ebx, ebx
mov ebx, ebx
xor esi, eax
mov esi, eax
mov esi, ebx
mov ebx, esi
mov ecx, dword [ebp + 0xc]
inc edx
neg edi
rcl ebx, 0x1c
not edi
or esi, 0x13
imul edx
neg edi
or eax, 0x9e
or eax, 0x2a
not ebx
bswap esi
rol ebx, 9
and ebx, 0xc4
dec ebx
rcr edi, 0x6e
neg ebx
neg esi
imul edi
rcl ebx, 0x29
neg eax
imul ebx
and esi, 0x8b
sbb ebx, 0xe9
add esi, 0x8e
rcl edi, 0x1b
rcr eax, 0x9d
imul ebx
rcr ebx, 0xc5
sbb edi, 0xe5
inc esi
not edi
rcr edi, 0x9a
rcr edi, 0x69
add ebx, 0x19
add edi, 0x71
bswap esi
imul ebx
inc esi
and eax, 0x8d
bswap edx
mov eax, 0x2b
rcr edx, 0x82
dec ebx
dec edi
inc eax
inc eax
add esi, 8
sub eax, 0x4b
rcl edx, 2
inc esi
mov edi, dword [ebp + 8]
mov eax, eax
xor eax, eax
mov ebx, eax
mov eax, eax
mov eax, eax
xor ebx, eax
xor esi, ebx
xor eax, ebx
mov eax, eax
not byte [edi]
mov ebx, ebx
xor esi, esi
mov eax, esi
xor eax, eax
mov esi, ebx
xor esi, esi
mov esi, eax
xor eax, esi
mov eax, eax
xor esi, ebx
mov ebx, ebx
mov esi, ebx
add byte [edi], 0xff
sub byte [edi], 0x4a
mov esi, ebx
mov ebx, esi
mov esi, esi
mov ebx, ebx
xor eax, eax
xor esi, esi
mov esi, eax
mov ebx, ebx
mov eax, esi
imul byte [edi]
inc edi
loop 0x401233
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404170
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4041af
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4041af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4041af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4041af
cmp dword [ecx + 0x74], 0xe
jbe 0x4041af
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x409d03
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x409da0
push ebx
push esi
call fcn.00409ccc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409c60
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x409d4d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409d9f
push edi
push eax
call fcn.0040a920
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x409d6d
call fcn.004087c1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x409d9e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409c60
add esp, 0x20
test eax, eax
jne 0x409d8c
push edi
call fcn.004087c1
jmp 0x409d94
push ebx
call fcn.004087c1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b09d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b040
push 0x41b038
push str.FlsAlloc
push 0x1f
call fcn.0040af5c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b0d1
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
jmp 0x40b0d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b11b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b050
push 0x41b048
push str.FlsGetValue
push 0x21
call fcn.0040af5c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b152
push dword [ebp + 8]
mov ecx, esi
call dword [0x413154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b15a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41b058
push 0x41b050
push str.FlsSetValue
push 0x22
call fcn.0040af5c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b194
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x413154]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41062d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41062d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10005986
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10005995
pop dword [ebp - 0xc]
mov eax, 0x10005995
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd63b7af6
sub dword [ebp - 0x1c], 0x87e935ab
mov dword [ebp - 0x18], 0x109e12bb
sub dword [ebp - 0x18], 0xde6ac676
mov dword [ebp - 0x14], 0x6b80b7d1
add dword [ebp - 0x14], 0xe0cb8c5d
mov dword [ebp - 0x10], 0xeadd5e1e
sub dword [ebp - 0x10], 0xeadd5e1e
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x4da47672
sub eax, 0x3da2a56a
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8a3b6213
sub dword [ebp - 0x1c], 0x15c8f8bd
mov dword [ebp - 0x18], 0x31689090
add dword [ebp - 0x18], 0x1003d0e5
mov dword [ebp - 0x14], 0x67c4a134
add dword [ebp - 0x14], 0xfbaacb38
mov dword [ebp - 0x10], 0x5e0bda6c
sub dword [ebp - 0x10], 0x5e0bda6c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x1bc2ec75
add eax, 0xf43ee3cf
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d502
push 0
call eax
mov ecx, 0x54450ec0
sub ecx, 0x5444ba7a
xor ebx, ebx
add ebx, eax
mov esi, 0xe1da888c
sub esi, 0xd1d7388c
add esi, dword [ebp - 0xc]
mov edi, 0x48fc0349
sub dword [ebp - 4], ecx
mov edx, dword [esi]
xor dword [ebp - 4], 0xb2b7c840
add edx, edi
sub dword [ebp - 4], eax
mov dword [ebx], edx
xor dword [ebp - 8], ecx
add ebx, 0xc8740b87
sub ebx, 0xc8740b83
add esi, 0x729596ff
add esi, 0x8d6a6905
loop 0x10005aae
add eax, 0x5a4c5ff
sub eax, 0x5a38214
xor ebx, ebx
add ebx, eax
add eax, 0x3f9e8b24
add eax, 0xc06174e1
mov ecx, 0x88f59aa4
add ecx, 0x870a655c
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x1000d45b
Capabilities:
Hash data using djb2

Disassembly:
movzx eax, word [ecx]
mov edx, 0x1505
push esi
xor esi, esi
jmp 0x1000d475
imul edx, edx, 0x21
movzx eax, ax
xor edx, eax
inc esi
movzx eax, word [ecx + esi*2]
test ax, ax
jne 0x1000d468
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x403e59
pop dword [ebp - 0x38]
mov eax, 0x403e59
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x876f589d
sub dword [ebp - 0x48], 0x391d1352
mov dword [ebp - 0x44], 0xcadc1168
sub dword [ebp - 0x44], 0x98a8c523
mov dword [ebp - 0x40], 0x5a8dac2d
sub dword [ebp - 0x40], 0xe4167ff
mov dword [ebp - 0x3c], 0x6af49700
sub dword [ebp - 0x3c], 0x6af49700
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x9c76bae0
sub dword [ebp - 0x48], 0x2804518a
mov dword [ebp - 0x44], 0x9d0e1722
add dword [ebp - 0x44], 0xa45e4a53
mov dword [ebp - 0x40], 0x5963164d
sub dword [ebp - 0x40], 0xf5f3a9e1
mov dword [ebp - 0x3c], 0xb5a4aa1b
sub dword [ebp - 0x3c], 0xb5a4aa1b
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x1aa2d353
add eax, 0xe59dad81
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x39109
push 0
call eax
mov ecx, 0x5145
mov edi, eax
mov ebx, 0x7be9badf
add ebx, 0x84575521
add ebx, dword [ebp - 0x38]
mov edx, 0xe7805b4
sub edx, 0xab533aee
sub dword [ebp - 0x18], eax
mov esi, dword [ebx]
sub dword [ebp - 0x24], esi
xor esi, edx
add dword [ebp - 0x10], 0x25e73022
mov dword [edi], esi
sub dword [ebp - 0x34], 0x91370e12
add edi, 0xa42c2d3e
sub edi, 0xa42c2d3a
add ebx, 0xe3887247
add ebx, 0x1c778dbd
loop 0x403f6b
add eax, 0x4b14ad44
sub eax, 0x4b13755d
xor ebx, ebx
add ebx, eax
add eax, 0x58d04a10
sub eax, 0x58d04a0b
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x415fa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x415fb2
pop dword [ebp - 0x1c]
mov eax, 0xdbbad5a5
sub eax, 0xdb7975f3
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3c3a4
push 0
mov eax, 0xadd5d969
add eax, 0x526c78af
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4195
mov ebx, eax
mov esi, 0x435400
add esi, dword [ebp - 0x1c]
mov edi, 0x43ca4c28
sub edi, 0xf0803b83
mov dword [ebp - 0x14], 0xe906ebfb
mov edx, dword [esi]
add dword [ebp - 0x18], 0x9cf1f902
xor edx, edi
xor dword [ebp - 4], 0xbae80562
mov dword [ebx], edx
add ebx, 0x659b1c8d
add ebx, 0x9a64e377
add esi, 4
loop 0x416005
add eax, 0xf927
xor ebx, ebx
add ebx, eax
add eax, 0xd67ac245
add eax, 0x29853dc0
mov ecx, 0x26f68631
sub ecx, 0x26b68631
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x4078e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x4b7034], 0
je 0x40790b
mov edx, edi
mov eax, esi
call dword [0x4b7034]
mov ebx, eax
jmp 0x40791c
mov eax, 8
call fcn.004053f0
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x4bb059], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x4078a8
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x40794c
mov eax, ebx
call fcn.0040540c
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc

Function at 0x419680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4196d9
test eax, edx
je 0x4196dc
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x419697
movzx eax, word [eax]
sub eax, ecx
jmp 0x4196be
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4196bf
add ecx, 4
js 0x4196af
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4196bc
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4196be
xor eax, eax
ret
test eax, eax
je 0x4196e8
test edx, edx
jne 0x419688
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret

Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x406744
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406769
mov eax, dword [0x40a8e8]
cmp eax, 0xffffffff
je 0x406760
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8e8], 0xffffffff
jmp 0x4067dc
cmp dword [0x43b9c0], ebx
je 0x4067dc
cmp byte [0x43b5c0], bl
je 0x4067a8
cmp dword [0x40a8e8], 0xffffffff
jne 0x4067b1
push 4
push 0x40000000
push 0x43b5c0
call fcn.0040610c
cmp eax, 0xffffffff
mov dword [0x40a8e8], eax
je 0x4067dc
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8e8], 0xffffffff
je 0x4067dc
push esi
mov esi, 0x43fa00
push 0x40aab8
push esi
call fcn.00406459
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.0040644c
push eax
push esi
push dword [0x40a8e8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4068a2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x43b1bc], esi
push edi
jne 0x4068dc
mov ecx, 0x43b1b8
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4068b8
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x43b5b8
jl 0x4068b3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x406911
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x43b1b8]
xor eax, esi
inc ecx
dec edx
jne 0x4068f4
pop edi
pop esi
not eax
ret 0xc

Function at 0xef8aa0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef8aaa
pushal
call 0xef8ab0
pop ebp
sub ebp, 0x10
sub ebp, 0xaf8aa0
jmp 0xef8ac6
mov eax, 0xaf8aa0
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d3
mov edx, 0xe44fd97f
xor byte [eax], dl
inc eax
dec ecx
jne 0xef8add
jmp 0xef8af0
hlt