joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x4d312f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404c94
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ebbb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41ebd4
lea eax, [ebp - 0x10]
mov edx, dword [0x4e8188]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404cf4
jmp 0x41ebe7
lea eax, [ebp - 0x10]
mov edx, dword [0x4e8188]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.00404cf4
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ebf3
adc edx, 0
mov edx, dword [edx*4 + 0x4e6ca8]
call fcn.00404ee4
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404ec8
push eax
call fcn.00406ab8
mov esi, eax
cmp esi, 0xffffffff
je 0x41ed01
mov eax, 0x40
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ecf4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d58
mov eax, edi
call fcn.00403270
mov eax, 0x18
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ecf4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ecf4
cmp dx, 0x150
ja 0x41ecf4
mov eax, edi
call fcn.00403270
mov eax, 0xe0
call fcn.00403250
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d00
test eax, eax
je 0x41ecf4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ecf4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404cd0
mov eax, edi
call fcn.00403270
push esi
call fcn.00406a70
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404ff0
jne 0x41ed19
inc ebx
cmp ebx, 0x19
jne 0x41ebad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3136
lea eax, [ebp - 0x10]
call fcn.00404c94
ret
Function at 0x10193b2
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
test dword [esp + esi*2 + 0xb], edx
push 1
call fcn.010193b2
and dword [esi - 0x7d], 0
lea ecx, [esi + 0x52]
test ecx, ecx
je 0x10193ab
push 0x29
call 0x10193e1
and dword [esi + 8], 0
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
push esi
mov ebx, dword [esi + 0x6cb8e8]
add dh, dh
inc ebp
or byte [ecx], al
je 0x10193cc
push esi
call fcn.01001ff8
fisttp qword [ebx + 0x755d5e64]
imul eax, dword [eax], 0xffffff90
inc edi
nop
nop
nop
mov esp, dword [esi + ebx*2 + 0x5d]
jne 0x101943d
add byte [eax - 0x6f6f6fb9], dl
add dword [eax], ecx
mov eax, 0x850400b7
call fcn.01002009
mov esi, ecx
mov dword [ecx], esi
in al, dx
mov dword [ebx + 0x58], 0x830100d2
jle 0x101940e
push 0xffffffffffffffc7
inc ebp
cld
add eax, 0x74c20000
jb 0x101938a
pop esi
sbb byte [ebx - 0x7ed61735], cl
invalid
test al, 0xc6
mov ecx, ebx
call 0x676618
mov ecx, edx
test dword [edx + 0x16a0774], esi
call fcn.0100d613
push dword [ebp - 0x74]
mov ecx, ebx
call fcn.010125ca
mov edi, dword [eax]
dec ebp
sti
je 0x1019456
mov ebp, dword [eax + 0x74c98545]
pop es
push 1
call 0xb800d613
lea eax, [edi + 8]
js 0x10193d2
into
call 0x1a019b73
push 1
mov ebp, dword [0xfffe70e8]
inc dword [ebp + 0x45]
inc ebp
inc ebp
invalid

Function at 0x1019a0d
Capabilities:
Encode data using xor

Disassembly:
call fcn.010198f0
mov ecx, 0x281
call 0x1019a0d
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x1019a10
mov eax, 0x504016d
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x10364c5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x404], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
push 0x3e6
push eax
mov word [ebp - 0x400], ax
lea eax, [ebp - 0x3fe]
push eax
call fcn.01002043
add esp, 0xc
xor eax, eax
push 0xa
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
push 0xc
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0x18]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1036523
sub eax, ecx
sar eax, 1
add eax, eax
push 0x20
pop ecx
mov word [ebp + eax - 0x18], cx
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
mov word [ebp + eax - 0x16], cx
mov ebx, 0x10366e4
mov edi, 0x1f4
jle 0x103659e
push dword [ebp + 0x10]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036594
cmp dword [ebp + 0x10], 1
push dword [ebp + 0xc]
push esi
jle 0x103658a
push 0x390
jmp 0x103658f
push 0x391
call fcn.0103645d
mov dword [ebp - 0x404], 1
cmp dword [ebp + 0x14], 0
jle 0x1036609
cmp dword [ebp - 0x404], 0
je 0x10365bc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
jmp 0x10365c6
mov dword [ebp - 0x404], 1
push dword [ebp + 0x14]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036609
cmp dword [ebp + 0x14], 1
push dword [ebp + 0xc]
push esi
jle 0x10365ff
push 0x392
jmp 0x1036604
push 0x393
call fcn.0103645d
cmp dword [ebp + 0x18], 0
jle 0x1036674
cmp dword [ebp - 0x404], 0
je 0x1036627
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
jmp 0x1036631
mov dword [ebp - 0x404], 1
push dword [ebp + 0x18]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x1036674
cmp dword [ebp + 0x18], 1
push dword [ebp + 0xc]
push esi
jle 0x103666a
push 0x394
jmp 0x103666f
push 0x395
call fcn.0103645d
cmp dword [ebp + 0x1c], 0
jle 0x10366d3
cmp dword [ebp - 0x404], 0
je 0x1036690
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
push dword [ebp + 0x1c]
lea eax, [ebp - 0x400]
push ebx
push edi
push eax
call fcn.01013d45
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0100440b
test eax, eax
jne 0x10366d3
cmp dword [ebp + 0x1c], 1
push dword [ebp + 0xc]
push esi
jle 0x10366c9
push 0x396
jmp 0x10366ce
push 0x397
call fcn.0103645d
mov ecx, dword [ebp - 4]
pop edi
pop esi
Function at 0x1000f7e1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x100142f0
call fcn.1001291d
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000f9b5
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10012345
add esp, 0xc
test eax, eax
js 0x1000f9af
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000f87d
push esi
call fcn.10004793
pop ecx
test al, al
je 0x1000f87d
mov eax, esi
call fcn.100129df
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000f889
push esi
lea ecx, [ebp - 0x428]
call fcn.10012345
push 3
push esi
push edi
push eax
call fcn.10012345
test eax, eax
je 0x1000f9af
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x1000f8bd
call fcn.10004911
mov esi, eax
jmp 0x1000f994
push dword [ebp - 0x424]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x1000f8e0
call fcn.10004911
jmp 0x1000f98b
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x1000f8d6
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x420], esi
cmp eax, esi
jae 0x1000f910
mov esi, 0x8007000e
jmp 0x1000f98d
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10012345
mov dword [ebp - 4], 1
jmp 0x1000f94f
cmp dword [ebp - 0x418], 0
je 0x1000f909
push esi
push dword [ebp - 0x424]
push esi
push dword [ebp - 0x418]
call fcn.10012345
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
call fcn.10012345
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000f9cf
lea ecx, [ebp - 0x418]
call fcn.1000fa38
jmp 0x1000f9cf
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1000f9ca
lea ecx, [ebp - 0x418]
call fcn.1000fa38
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.100048c2
mov eax, esi
lea esp, [ebp - 0x444]
call fcn.10012976
ret 0x10
Function at 0x10011ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100025c8]
jne 0x10012a72
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10018880], eax
mov dword [0x1001887c], ecx
mov dword [0x10018878], edx
mov dword [0x10018874], ebx
mov dword [0x10018870], esi
mov dword [0x1001886c], edi
mov word [0x10018898], ss
mov word [0x1001888c], cs
mov word [0x10018868], ds
mov word [0x10018864], es
mov word [0x10018860], fs
mov word [0x1001885c], gs
pushfd
pop dword [0x10018890]
mov eax, dword [ebp]
mov dword [0x10018884], eax
mov eax, dword [ebp + 4]
mov dword [0x10018888], eax
lea eax, [ebp + 8]
mov dword [0x10018894], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100187d0], 0x10001
mov eax, dword [0x10018888]
mov dword [0x10018784], eax
mov dword [0x10018778], 0xc0000409
mov dword [0x1001877c], 1
mov eax, dword [0x100025c8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10018438]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x100187c8], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x100027c8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x100187c8], 0
jne 0x10012b5e
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x10012345
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10012354
pop dword [ebp - 0x28]
mov eax, 0xaa7c1051
sub eax, 0x9a7aecfd
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3b66f
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xe0230afb
sub ecx, 0xe022b9fe
mov esi, eax
mov edi, 0xecb0febb
sub edi, 0xdcaf32bb
add edi, dword [ebp - 0x28]
mov ebx, 0x64e6dd1e
add ebx, 0xc6e7199f
sub dword [ebp - 0x10], 0x1e843555
mov edx, dword [edi]
xor dword [ebp - 8], esi
xor edx, ebx
mov dword [ebp - 0xc], 0xb8b0b4b1
mov dword [esi], edx
mov dword [ebp - 0x24], 0x73240084
add esi, 0xae0e5a05
sub esi, 0xae0e5a01
add edi, 0x39fbe3c0
sub edi, 0x39fbe3bc
loop 0x100123ae
add eax, 0x1d2765f
sub eax, 0x1d13f98
mov ebx, eax
add eax, 5
mov ecx, 0xa318726c
add ecx, 0x6ce78d94
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x409d30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x188
mov eax, dword [0x44f8e4]
xor eax, esp
mov dword [esp + 0x184], eax
mov edx, dword [esp + 0x194]
push ebx
mov ebx, dword [esp + 0x194]
push ebp
mov ebp, dword [esp + 0x194]
push esi
mov esi, ebp
mov dword [esp + 0xc], edx
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x409d66
sub esi, ecx
cmp esi, 0x80
jle 0x409d7e
mov esi, 0x80
jmp 0x409db2
mov eax, esi
mov dword [ebx], esi
and eax, reloc.WS2_32.dll_ntohs
jns 0x409d90
dec eax
or eax, 0xfffffff0
add eax, 1
je 0x409db4
mov edi, 0x10
sub edi, eax
test edi, edi
jle 0x409db2
push edi
lea eax, [esi + ebp]
push 0
push eax
call fcn.00422430
mov edx, dword [esp + 0x1c]
add esp, 0xc
add esi, edi
mov dword [ebx], esi
mov edi, edx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x409dc0
sub edi, ecx
lea eax, [esp + 0x84]
push edi
push edx
push eax
call fcn.00421eb0
mov eax, dword [esp + 0x1b4]
lea ecx, [esp + 0x90]
add ecx, edi
mov dword [esp + 0x1c], ecx
movups xmm0, xmmword [eax]
lea eax, [esp + 0x28]
push eax
movups xmmword [ecx], xmm0
call fcn.0041b270
lea eax, [edi + 0x10]
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x34]
push eax
call fcn.0041b2a0
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x94]
push eax
call fcn.0041b370
lea ecx, [esp + 0xa7]
add esp, 0x24
lea eax, [ebp + 0xf]
cmp ebp, ecx
ja 0x409e60
lea ecx, [esp + 0x74]
cmp eax, ecx
jb 0x409e60
lea edi, [esp + 0x74]
mov ecx, ebp
sub edi, ebp
mov edx, 0x10
nop
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x409e50
jmp 0x409e71
movups xmm1, xmmword [ebp]
movups xmm0, xmmword [esp + 0x74]
pxor xmm1, xmm0
movups xmmword [ebp], xmm1
cmp esi, 0x10
jle 0x409f36
lea eax, [esi - 0x10]
mov ebx, 0xfffffff0
mov dword [esp + 0x18], eax
lea esi, [ebp + 0x10]
sub ebx, ebp
nop dword [eax + eax]
lea edi, [ebx + esi]
cmp edi, eax
jg 0x409f36
mov eax, dword [esp + 0x10]
movups xmm0, xmmword [esi - 0x10]
movups xmmword [eax], xmm0
lea eax, [esp + 0x1c]
push eax
call fcn.0041b270
push dword [esp + 0x18]
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041b2a0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.0041b370
lea eax, [ebp + 0x1f]
add esp, 0x18
lea ecx, [esp + 0x83]
xor edx, edx
add eax, edi
cmp esi, ecx
ja 0x409f12
lea ecx, [esp + 0x74]
cmp eax, ecx
jb 0x409f12
mov eax, esi
nop word [eax + eax]
mov cl, byte [esp + edx + 0x74]
lea eax, [eax + 1]
xor byte [eax - 1], cl
inc edx
cmp edx, 0x10
jl 0x409f00
jmp 0x409f21
movups xmm1, xmmword [esi]
movups xmm0, xmmword [esp + 0x74]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
add esi, 0x10
lea eax, [ebx + esi]
cmp eax, 0x80
mov eax, dword [esp + 0x18]
jl 0x409e90
mov ecx, dword [esp + 0x194]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cbf
add esp, 0x188
ret
Function at 0x419ae0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push edi
mov edi, dword [esp + 0x14]
lea eax, [esp + 4]
push eax
push 0x8004667e
push edi
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
call dword [0x44f260]
test eax, eax
je 0x419b2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x419b2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
jne 0x419b5d
xorps xmm0, xmm0
mov eax, 0x10
movlpd qword [esp + 8], xmm0
mov word [esp + 0xc], ax
imul eax, dword [esp + 0x20], 0x3e8
mov dword [esp + 8], edi
push eax
push 1
lea eax, [esp + 0x10]
push eax
call dword [0x44f274]
test eax, eax
jg 0x419b67
mov eax, 0xd
pop edi
add esp, 0xc
ret
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x419b70
Capabilities:
Encode data using xor

Disassembly:
push ecx
movzx eax, word [0x44f408]
xor ecx, ecx
mov dword [esp], eax
mov eax, dword [esp + 0xc]
cdq
sub eax, edx
mov edx, eax
sar edx, 1
push esi
push edi
test edx, edx
jle 0x419c1b
mov edi, dword [esp + 0x10]
cmp edx, 0x10
jb 0x419c05
mov eax, edx
and eax, reloc.WS2_32.dll_ntohs
jns 0x419ba9
dec eax
or eax, 0xfffffff0
inc eax
mov esi, edx
xorps xmm2, xmm2
sub esi, eax
xorps xmm1, xmm1
movups xmm0, xmmword [edi + ecx*2]
pxor xmm2, xmm0
movups xmm0, xmmword [edi + ecx*2 + 0x10]
add ecx, 0x10
pxor xmm1, xmm0
cmp ecx, esi
jl 0x419bb3
mov si, word [esp + 8]
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movd eax, xmm1
xor si, ax
cmp ecx, edx
jge 0x419c20
jmp 0x419c10
mov si, word [esp + 8]
nop word [eax + eax]
xor si, word [edi + ecx*2]
inc ecx
cmp ecx, edx
jl 0x419c10
jmp 0x419c20
mov si, word [esp + 8]
call fcn.0042ac40
movzx ecx, si
add eax, ecx
push eax
call fcn.0042ac61
add esp, 4
call fcn.0042ac40
pop edi
mov dword [0x44f408], eax
pop esi
add esp, 4
jmp fcn.0042ac40

Function at 0x41b270
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x41bec0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x41c660
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x41c70e
mov edx, dword [esp + 8]
add edx, 2
push edi
nop dword [eax]
movzx ecx, byte [edx - 2]
shr ecx, 2
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
cmp esi, 1
jbe 0x41c69d
movzx edi, byte [edx - 1]
shr edi, 4
jmp 0x41c69f
xor edi, edi
movzx ecx, byte [edx - 2]
and ecx, 3
shl ecx, 4
or ecx, edi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jbe 0x41c6f3
cmp esi, 2
jbe 0x41c6c6
movzx edi, byte [edx]
shr edi, 6
jmp 0x41c6c8
xor edi, edi
movzx ecx, byte [edx - 1]
and ecx, 0xf
shl ecx, 2
or ecx, edi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
add eax, 3
cmp esi, 2
jbe 0x41c6fa
movzx ecx, byte [edx]
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x41c6fc
mov byte [eax + 2], 0x3d
add eax, 3
mov cl, 0x3d
mov byte [eax], cl
sub esi, 3
inc eax
add edx, 3
test esi, esi
jg 0x41c680
pop edi
mov byte [eax], 0
pop esi
ret
Function at 0x41e2e0
Capabilities:
Encode data using xor
Get hostname

Disassembly:
sub esp, 0x48c
mov eax, dword [0x44f8e4]
xor eax, esp
mov dword [esp + 0x488], eax
mov eax, dword [esp + 0x498]
push ebx
push ebp
mov ebp, dword [esp + 0x498]
push esi
push edi
mov edi, dword [esp + 0x4a4]
push 0x400
mov dword [esp + 0x18], eax
lea eax, [esp + 0x9c]
push 0
push eax
call fcn.00422430
add esp, 0xc
mov dword [esp + 0x98], 0x4d4c544e
lea eax, [esp + 0x18]
mov dword [esp + 0x9c], 0x505353
mov byte [esp + 0xa0], 2
push 0x80
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea ecx, [esp + 0x18]
mov byte [esp + 0x27], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e362
sub ecx, edx
mov byte [esp + 0xa8], 0x30
mov dword [esp + 0xac], 0xa0818203
lea ebx, [esp + 0x18]
xor esi, esi
lea eax, [ecx + ecx]
mov dword [esp + 0x10], eax
mov byte [esp + 0xa4], al
mov byte [esp + 0xa6], al
mov al, byte [esp + 0x18]
nop dword [eax]
movsx eax, al
push eax
call fcn.0042aeca
mov byte [esp + esi + 0xcc], al
lea ebx, [ebx + 1]
mov al, byte [ebx]
add esp, 4
mov byte [esp + esi + 0xc9], 0
add esi, 2
test al, al
je 0x41e3cc
cmp esi, 0x40
jl 0x41e3a0
push edi
call fcn.00427674
xor eax, eax
add esp, 4
cmp word [ebp + 0x12c], 0x17
sete al
lea eax, [eax*4 + 0x130]
mov eax, dword [eax + ebp]
mov dword [edi + 4], eax
mov al, byte [ebp + 0x12e]
xor byte [edi + 1], al
xor esi, esi
nop word [eax + eax]
push 8
push edi
call fcn.00419b70
xor byte [edi + esi], al
add esp, 8
inc esi
cmp esi, 8
jl 0x41e400
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x10]
add eax, 0x30
mov dword [esp + 0xb4], ecx
push eax
push dword [esp + 0x18]
lea eax, [esp + 0xa0]
push eax
call fcn.0041c660
mov ecx, dword [esp + 0x4a4]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cbf
add esp, 0x48c
ret

Function at 0x4336ea
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433560

Function at 0x439d75
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004398c8
Function at 0x401d60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401dab
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401da4
test esi, esi
je 0x401da4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d80
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f90
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4020b4
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x40201e
cmp eax, 4
jne 0x402040
test esi, esi
je 0x402032
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x402024
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40207f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402071
cmp ecx, 0x40
je 0x402032
cmp ecx, 4
je 0x402032
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f90
lea esi, [esi]