joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000186f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ecx
cmp dword [esi + 0x24], 0
push ebx
push ebp
push edi
jne 0x10001881
xor eax, eax
jmp 0x10001958
mov edi, dword [esi + 0x13f0]
mov eax, edi
cdq
mov ebx, closesocket
add eax, ebx
adc edx, 0
mov dword [esp + 0x10], edx
mov ebp, 0x1000
js 0x100018e5
jg 0x100018a5
cmp eax, ebp
jbe 0x100018e5
mov ecx, dword [esi + 0x13ec]
test ecx, ecx
je 0x100018e5
cmp edi, ebp
je 0x100018bc
mov eax, edi
sub eax, ecx
cmp eax, 0x10
jg 0x100018e5
mov eax, edi
sub eax, ecx
push eax
mov dword [esi + 0x13f0], eax
lea eax, [ecx + esi + 0x3ec]
push eax
lea eax, [esi + 0x3ec]
push eax
call sub.MSVCRT.dll_memmove
add esp, 0xc
and dword [esi + 0x13ec], 0
mov eax, dword [esi + 0x13f0]
mov ecx, ebp
sub ecx, eax
cmp ecx, ebx
jle 0x100018f5
mov ecx, ebx
mov edx, dword [esi + 0x18]
xor ebx, ebx
cmp edx, ebx
lea eax, [eax + esi + 0x3ec]
je 0x10001912
push ecx
push eax
push edx
call fcn.10024b2c
add esp, 0xc
jmp 0x1000191e
push ebx
push ecx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jge 0x1000192c
mov dword [esi + 0x24], ebx
jmp 0x1000187a
mov eax, dword [esi + 0x3e8]
cmp eax, ebx
je 0x10001944
push ebx
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10001924
add dword [esi + 0x13f0], edi
cmp edi, ebx
jne 0x10001955
mov dword [esi + 0x28], 1
mov eax, dword [esi + 0x24]
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x100027e8
Capabilities:
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
push str..cached_header
push dword [ebp + 8]
call fcn.10003831
push str..cached_part
push dword [eax]
mov dword [ebp - 0xc], eax
call fcn.10003831
add esp, 0x10
xor edi, edi
push edi
push edi
push 2
push edi
push 1
push 0x40000000
push dword [eax]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x10002846
mov esi, dword [ebp - 0xc]
call fcn.100037e1
mov esi, dword [ebp - 0x10]
call fcn.100037e1
mov eax, edi
pop edi
pop esi
leave
ret
push edi
push edi
push edi
push edi
push edi
push edi
push 0x100361a1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0xe
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 0x40], 0x16
mov dword [ebp - 0x3c], 0x14
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], 0xd
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x2c], 0x15
mov dword [ebp - 0x28], 0x1c
mov dword [ebp - 0x24], 0x1d
mov dword [ebp - 0x20], 0x1e
mov dword [ebp - 0x1c], 0x1f
mov dword [ebp - 0x18], 0x20
call fcn.1000384d
add esp, 0x1c
mov esi, eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x4c]
mov ecx, dword [ebx + eax*8 + 0x2d8]
cmp dword [ecx + 4], edi
je 0x100028ed
mov eax, dword [ebx + eax*8 + 0x2d4]
mov eax, dword [eax]
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ecx]
push esi
call fcn.10003a58
add esp, 0x20
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xe
jb 0x100028c0
mov eax, dword [ebx + 0x180]
mov eax, dword [eax]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push esi
call fcn.10003a58
add esp, 0x20
push edi
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
push dword [esi]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.10003809
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
push 9
push dword [eax]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edi, edi
inc edi
jmp 0x10002830
Function at 0x10002949
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
push str..cached_header
push dword [ebp + 0xc]
call fcn.10003831
pop ecx
pop ecx
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002974
test al, 0x10
je 0x1000297c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esi]
call fcn.100034bd
mov edi, eax
pop ecx
mov dword [ebp - 0x10], edi
call fcn.100037e1
test edi, edi
jne 0x10002999
xor eax, eax
jmp 0x10002ae5
mov esi, dword [ebp + 8]
push ebx
push 0x21
add esi, 0x2d8
pop ebx
mov ecx, dword [esi]
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.100038c9
add esp, 0x10
add esi, 8
dec ebx
jne 0x100029a6
mov esi, dword [edi]
mov eax, dword [edi + 4]
add eax, esi
cmp esi, eax
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x40], 0xe
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], 0x16
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x28], 0x15
mov dword [ebp - 0x24], 0x1c
mov dword [ebp - 0x20], 0x1d
mov dword [ebp - 0x1c], 0x1e
mov dword [ebp - 0x18], 0x1f
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 4], eax
je 0x10002adc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp + 8]
lea edi, [eax + ebx*8 + 0x2d4]
mov eax, dword [edi]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10002aa4
mov edx, dword [ebp - 4]
sub edx, esi
cmp ecx, edx
jg 0x10002aa4
mov eax, dword [eax]
push esi
call fcn.10004001
test eax, eax
pop ecx
je 0x10002aa4
mov eax, dword [edi]
add esi, dword [eax + 4]
cmp esi, dword [ebp - 4]
mov edi, esi
jmp 0x10002a82
push 0x10036468
push edi
call fcn.10003fe0
test eax, eax
pop ecx
pop ecx
jne 0x10002a87
inc edi
cmp edi, dword [ebp - 4]
mov dword [ebp - 0xc], edi
jne 0x10002a6d
mov eax, dword [ebp + 8]
sub edi, esi
push esi
mov esi, dword [eax + ebx*8 + 0x2d8]
call fcn.10003884
mov esi, dword [ebp - 0xc]
pop ecx
mov dword [ebp - 0xc], 1
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xd
jb 0x10002a31
cmp dword [ebp - 0xc], 0
jne 0x10002ab4
inc esi
cmp esi, dword [ebp - 4]
je 0x10002ad9
push 0x10036468
push esi
call fcn.10003fe0
test eax, eax
pop ecx
pop ecx
jne 0x10002ad0
inc esi
cmp esi, dword [ebp - 4]
jne 0x10002ab9
cmp esi, dword [ebp - 4]
jne 0x10002a29
mov edi, dword [ebp - 0x10]
call fcn.1000359f
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1000343c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x10049cf0], 0
push esi
push edi
mov edx, 0xff
jne 0x1000347b
xor esi, esi
push 8
mov ecx, esi
pop edi
test cl, 1
je 0x10003462
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x10003464
shr ecx, 1
dec edi
jne 0x10003453
mov edi, esi
xor edi, edx
inc esi
cmp esi, 0x100
mov dword [edi*4 + 0x10049cf0], ecx
jb 0x1000344e
xor ecx, ecx
cmp dword [esp + 0x10], ecx
jle 0x100034a7
mov esi, dword [esp + 0xc]
movzx esi, byte [ecx + esi]
mov edi, eax
and edi, edx
shr eax, 8
xor esi, edi
xor eax, dword [esi*4 + 0x10049cf0]
xor eax, 0xff000000
inc ecx
cmp ecx, dword [esp + 0x10]
jl 0x10003483
pop edi
pop esi
ret

Function at 0x100034bd
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push dword [ebp + 8]
call fcn.10003423
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
mov dword [ebp - 0xc], ebx
jne 0x100034db
xor eax, eax
jmp 0x1000354e
push esi
push edi
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10003543
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x10003543
push esi
push esi
push esi
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x10], edi
je 0x10003543
mov eax, dword [ebp - 8]
push esi
push esi
push esi
push 4
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x10003530
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
jmp 0x1000354a
push 0x10
call sub.MSVCRT.dll_malloc
lea esi, [ebp - 0x18]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
movsd dword es:[edi], dword [esi]
jmp 0x1000354c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10004263
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push edi
xor edi, edi
push 0x206
lea eax, [ebp - 0x206]
push edi
push eax
mov word [ebp - 0x208], di
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x100042e4
push esi
push 0x104
lea eax, [ebp - 0x208]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x208]
push edi
push eax
call fcn.10003831
mov esi, eax
mov eax, dword [esi + 4]
cmp eax, edi
pop ecx
pop ecx
je 0x100042df
mov ecx, dword [esi]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x100042df
push 0x5c
call fcn.100039f2
pop ecx
mov eax, esi
pop esi
jmp 0x100042f1
push edi
push 0x100361a4
call fcn.10003831
pop ecx
pop ecx
pop edi
leave
ret
Function at 0x10011ee3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, word [esi + 0x10]
push ebx
xor ebx, ebx
cmp ax, bx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x10011f2a
mov eax, dword [esi + 0xc]
imul eax, eax, 0x20080825
push 0xdff6dffa
push 0xe689e67e
mov edi, 0xa20191cb
sub edi, eax
push ebx
push edi
mov dword [esi + 0xc], edi
call fcn.100350d0
and edi, 7
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ebx, edi
movzx eax, word [esi + 0x10]
lea ecx, [eax + ebx + 4]
shr ecx, 4
lea edi, [esi + 0x1010]
mov byte [edi], cl
mov cl, byte [esi + 0x10]
add cl, bl
add cl, 4
and cl, 0xf
mov byte [esi + 0x1011], cl
mov cx, word [esi + 0x12]
xor cx, word [edi]
xor edx, edx
xor cx, 0x4000
test ax, ax
mov word [esi + 0x1012], cx
jbe 0x10011f85
movzx eax, dx
lea ecx, [eax + esi]
and eax, 3
mov al, byte [eax + esi + 0xc]
xor al, byte [ecx + 0x14]
inc edx
mov byte [ecx + 0x1014], al
cmp dx, word [esi + 0x10]
jb 0x10011f68
push ebx
lea eax, [ebp - 8]
push eax
movzx eax, word [esi + 0x10]
lea eax, [eax + esi + 0x1014]
push eax
call sub.MSVCRT.dll_memcpy
movzx eax, word [esi + 0x10]
push edi
push dword [ebp + 8]
lea eax, [eax + ebx + 4]
call fcn.100215e3
add esp, 0x14
pop edi
pop ebx
leave
ret
Function at 0x10021567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [ebp + 8]
call fcn.10003551
mov ebx, eax
test ebx, ebx
pop ecx
je 0x100215dd
xor eax, eax
mov cl, byte [eax + 0x1003f0e8]
xor cl, 0x80
mov byte [ebp + eax - 0x14], cl
inc eax
cmp eax, 0x14
jl 0x1002157f
mov eax, dword [0x1003f0fc]
push edi
lea ecx, [ebp - 0x14]
push ecx
push dword [ebx + 4]
add eax, 0x14
push dword [ebx]
call fcn.100033d0
add esp, 0xc
test eax, eax
je 0x100215c8
mov edi, dword [0x1003f0fc]
push esi
mov esi, dword [0x1004a3f8]
add eax, 0x14
push eax
call fcn.10003884
pop ecx
pop esi
push 0x14
pop ecx
lea eax, [ebp - 0x14]
mov byte [eax], 0
inc eax
dec ecx
jne 0x100215ce
mov edi, ebx
call fcn.1000359f
pop edi
xor eax, eax
inc eax
pop ebx
leave
ret

Function at 0x100215e3
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
mov edi, eax
xor esi, esi
jmp 0x10021615
cmp edi, 0x1000
mov eax, 0x1000
jg 0x100215fa
mov eax, edi
push 0
push eax
mov eax, dword [esp + 0x18]
add eax, esi
push eax
push dword [esp + 0x18]
call sub.WS2_32.dll_send
test eax, eax
jle 0x1002161f
sub edi, eax
add esi, eax
test edi, edi
jne 0x100215eb
xor eax, eax
inc eax
pop edi
pop esi
ret
xor eax, eax
jmp 0x1002161c

Function at 0x10021623
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov edi, eax
xor esi, esi
jmp 0x10021655
cmp edi, 0x1000
mov eax, 0x1000
jg 0x1002163a
mov eax, edi
push 0
push eax
mov eax, dword [esp + 0x18]
add eax, esi
push eax
push dword [esp + 0x18]
call sub.WS2_32.dll_recv
test eax, eax
jle 0x1002165f
sub edi, eax
add esi, eax
test edi, edi
jne 0x1002162b
xor eax, eax
inc eax
pop edi
pop esi
ret
xor eax, eax
jmp 0x1002165c
Function at 0x100216d1
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x402c
call fcn.10035110
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x4004667f
push edi
push dword [ebp + 8]
call sub.WS2_32.dll_ioctlsocket
test eax, eax
jne 0x10021774
xor ebx, ebx
cmp dword [ebp - 4], ebx
je 0x1002177b
push ebx
push 0x4000
lea eax, [ebp - 0x4028]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_recv
mov esi, eax
cmp esi, ebx
jle 0x10021774
mov eax, dword [ebp + 0x10]
mov ax, word [eax + 8]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
mov word [ebp - 0x14], si
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 0x4028]
push eax
push dword [ebp + 0xc]
mov eax, esi
call fcn.100215e3
test eax, eax
pop ecx
pop ecx
je 0x10021774
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call sub.WS2_32.dll_ioctlsocket
test eax, eax
je 0x100216f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp + 0x14]
push eax
mov esi, 0x8004667e
push esi
push dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp + 0x14], edi
call sub.WS2_32.dll_ioctlsocket
test eax, eax
jne 0x10021774
push 2
push edi
lea eax, [ebp - 0x4028]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
jne 0x100217be
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x100217be
xor edi, edi
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp + 0x14], ebx
call sub.WS2_32.dll_ioctlsocket
test eax, eax
jne 0x10021774
cmp edi, ebx
setne al
jmp 0x10021776
Function at 0x10022441
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edi
call fcn.100223db
lea eax, [ebp - 0x24]
push eax
push dword [edi + 0x18]
push 4
pop eax
call fcn.10021623
test eax, eax
pop ecx
pop ecx
je 0x100224c4
cmp dword [edi + 0x1c], 1
jne 0x10022488
movzx ecx, byte [ebp - 0x23]
movzx eax, byte [edi + 0xd]
movzx edx, byte [ebp - 0x24]
xor eax, ecx
movzx ecx, byte [edi + 0xc]
shl eax, 8
xor ecx, edx
lea ebx, [eax + ecx - 4]
jmp 0x100224bc
movzx ebx, byte [ebp - 0x23]
mov al, bl
and al, 0x30
cmp al, 0x10
je 0x100224a4
movzx eax, byte [ebp - 0x24]
and ebx, 0xf
shl eax, 4
lea ebx, [ebx + eax - 4]
jmp 0x100224bc
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0x18]
push 0x12
pop eax
call fcn.10021623
test eax, eax
pop ecx
pop ecx
je 0x100224c4
mov ebx, dword [ebp - 0x12]
cmp ebx, 0x1000000
jb 0x100224cd
and dword [ebp - 4], 0
jmp 0x100225b9
cmp dword [edi + 0x1c], 1
mov dword [edi + 4], ebx
lea eax, [edi + 0xe]
je 0x100224dc
lea eax, [ebp - 0x24]
mov ax, word [eax]
xor ax, word [ebp - 0x22]
cmp ebx, 0xffc
mov word [edi + 8], ax
jbe 0x10022506
mov esi, dword [edi + 0x14]
call fcn.10003809
mov esi, dword [edi + 4]
call fcn.100037ac
mov dword [edi + 0x14], eax
mov eax, dword [eax]
mov dword [edi], eax
push dword [edi]
mov eax, dword [edi + 4]
push dword [edi + 0x18]
call fcn.10021623
test eax, eax
pop ecx
pop ecx
je 0x100225cd
cmp dword [edi + 0x1c], 0
mov dword [ebp - 4], 1
jne 0x1002259d
test ebx, ebx
je 0x1002259d
mov ecx, dword [edi + 0xc]
imul ecx, ecx, 0x20080825
push 0xdff6dffa
push 0xe689e67e
mov eax, 0xa20191cb
sub eax, ecx
push 0
push eax
mov dword [edi + 0xc], eax
call fcn.100350d0
mov dword [ebp - 0xc], eax
movzx eax, byte [edi + 0xc]
and eax, 7
mov esi, eax
mov eax, dword [edi + 4]
cmp esi, eax
mov dword [ebp - 8], edx
ja 0x100225cd
sub eax, esi
add eax, dword [edi]
push esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100225cd
mov eax, dword [edi + 4]
sub eax, esi
add eax, dword [edi]
test esi, esi
mov dword [ebp - 4], 1
mov ecx, esi
je 0x1002259a
mov byte [eax], 0
inc eax
dec ecx
jne 0x10022593
sub dword [edi + 4], esi
xor ecx, ecx
cmp dword [edi + 4], ecx
jbe 0x100225b9
mov eax, dword [edi]
mov edx, ecx
and edx, 3
mov dl, byte [edx + edi + 0xc]
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, dword [edi + 4]
jb 0x100225a4
push 0x16
pop ecx
pop esi
lea eax, [ebp - 0x24]
pop ebx
mov byte [eax], 0
inc eax
dec ecx
jne 0x100225c1
mov eax, dword [ebp - 4]
leave
ret
and dword [ebp - 4], 0
mov esi, edi
call fcn.100223db
jmp 0x100225b9
Function at 0x100225da
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x10022601
call fcn.10024d93
push dword [ebp + 8]
call fcn.10021567
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
pop ecx
xor esi, esi
push esi
push esi
push esi
push 0x1000a8bf
push esi
push esi
call edi
mov ebx, 0x1003f100
mov dword [esp + 0xc], 7
push esi
push esi
push ebx
push 0x10021e35
push esi
push esi
call edi
add ebx, 0x28
dec dword [esp + 0xc]
jne 0x1002262b
push esi
push esi
push esi
push 0x10021f9a
push esi
push esi
call edi
push esi
push esi
push esi
push 0x10015541
push esi
push esi
call edi
push esi
push esi
push esi
push 0x100210ce
push esi
push esi
call edi
push esi
push esi
push esi
push 0x10010e32
push esi
push esi
call edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100234f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
mov esi, edx
jne 0x100234fe
xor eax, eax
pop esi
ret
cmp eax, 8
push ebx
not esi
mov edx, 0xff
jb 0x100235b0
push edi
mov edi, eax
shr edi, 3
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
sub eax, 8
dec edi
jne 0x10023515
pop edi
test eax, eax
je 0x100235c9
movzx ebx, byte [ecx]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x1003d638]
inc ecx
dec eax
jne 0x100235b4
mov eax, esi
pop ebx
not eax
pop esi
ret
Function at 0x10025193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push esi
push edi
mov edi, eax
lea esi, [edi + 1]
shr esi, 1
cmp esi, 0x80
ja 0x10025288
mov eax, dword [ebp + 0x1c]
add eax, ebx
cmp eax, 0x50
mov dword [ebp - 4], eax
ja 0x10025288
cmp dword [ebp + 0xc], 0xe0
ja 0x10025288
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0xd8]
push eax
call sub.MSVCRT.dll_memcpy
and edi, 1
mov eax, esi
sub eax, edi
add eax, dword [ebp + 0x10]
add esp, 0xc
push esi
push eax
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x58]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp + 0x1c]
lea eax, [ebp + ebx - 0x58]
push dword [ebp + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [ebp + 0xc]
add esp, 0xc
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x318]
push edi
push eax
xor eax, eax
inc eax
mov ecx, esi
call fcn.10025064
add esp, 0x14
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x158]
push eax
push edi
lea eax, [ebp - 0x238]
push eax
push 2
pop eax
mov ecx, esi
call fcn.10025064
add esp, 0x14
xor eax, eax
test edi, edi
jbe 0x10025288
mov cl, byte [ebp + eax - 0x238]
xor cl, byte [ebp + eax - 0x318]
mov edx, dword [ebp + 8]
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x1002526f
pop edi
pop esi
leave
ret

Function at 0x1002a40e
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret

Function at 0x1002aad1
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esi]
push ebx
push edi
lea edi, [esi + 4]
mov ecx, dword [edi]
lea edx, [eax + ecx]
cmp edx, ecx
mov dword [edi], edx
jae 0x1002aae6
inc dword [esi + 8]
mov byte [eax + esi + 0x1c], 0x80
inc dword [esi]
mov eax, dword [esi]
xor ebx, ebx
cmp eax, 0x38
jbe 0x1002ab19
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
mov dword [esi], 0x40
call fcn.1002a435
mov dword [esi], ebx
mov eax, dword [esi]
push 0x38
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [edi]
mov ecx, eax
shl eax, 3
lea ebx, [esi + 8]
mov edx, dword [ebx]
push 4
shr ecx, 0x1d
mov dword [edi], eax
lea eax, [esi + 0x54]
lea ecx, [ecx + edx*8]
push edi
push eax
mov dword [ebx], ecx
call sub.MSVCRT.dll_memcpy
push 4
lea eax, [esi + 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, esi
call fcn.1002a435
push 0x10
lea eax, [esi + 0xc]
push eax
push dword [esp + 0x38]
call sub.MSVCRT.dll_memcpy
add esp, 0x30
pop edi
mov eax, esi
pop ebx
jmp fcn.1002a40e