joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003751
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1004df0
call fcn.01003914
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10064f4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003566
cmp eax, esi
jne 0x1003559
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003569
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003540
xor esi, esi
inc esi
mov eax, dword [0x10064f0]
cmp eax, esi
jne 0x100357c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10035b7
mov eax, dword [0x10064f0]
test eax, eax
jne 0x10035b1
mov dword [0x10064f0], esi
push 0x100115c
push 0x1001150
call fcn.010034bd
pop ecx
pop ecx
test eax, eax
je 0x10035b7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1003681
mov dword [0x100605c], esi
mov eax, dword [0x10064f0]
cmp eax, esi
jne 0x10035db
push 0x100114c
push 0x1001140
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10064f0], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10035e8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10064f8], ebx
je 0x1003609
push 0x10064f8
call fcn.01003889
pop ecx
test eax, eax
je 0x1003609
push ebx
push 2
push ebx
call dword [0x10064f8]
push dword [0x1006044]
push dword [0x1006048]
push dword [0x1006040]
call fcn.01003407
add esp, 0xc
mov dword [0x1006058], eax
cmp dword [0x100604c], ebx
jne 0x1003667
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x100605c], ebx
jne 0x1003675
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1006058]
call fcn.01003959
ret
call fcn.01003b07
jmp 0x100351e
Function at 0x10045d8
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x100476c
xor eax, eax
cmp ax, word [esi]
je 0x100476c
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.010043d6
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1004755
push edi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], ebx
call fcn.010043b8
cmp eax, ebx
jl 0x10046e9
cmp dword [ebp - 0x1c], 1
jne 0x10046b4
mov eax, dword [ebp - 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100464e
mov ecx, dword [ebp - 0x14]
sub eax, edx
sar eax, 1
lea esi, [ecx + eax*2]
cmp dword [ebp - 0xc], ebx
je 0x1004678
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov esi, eax
pop ecx
push dword [ebp - 8]
cmp esi, ebx
je 0x1004729
xor eax, eax
mov word [esi], ax
call fcn.01004d01
test eax, eax
jne 0x10046aa
push ebx
push dword [ebp - 8]
call edi
push 0x5c
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x100467e
mov esi, dword [ebp - 0x14]
movzx eax, word [esi]
cmp ax, 0x61
jb 0x10046c6
cmp ax, 0x7a
jbe 0x10046d2
cmp ax, 0x41
jb 0x1004678
cmp ax, 0x5a
ja 0x1004678
push 0x3a
pop eax
cmp ax, word [esi + 2]
jne 0x1004678
push 0x5c
pop eax
cmp ax, word [esi + 4]
jne 0x1004678
add esi, 8
jmp 0x1004678
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1001dc8
push 0x3000000
push 0x10063d0
mov dword [ebp - 0x10], eax
call fcn.01004112
add esp, 0x14
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
jmp 0x100475e
call fcn.01004d01
xor esi, esi
inc esi
cmp eax, esi
je 0x1004750
push ebx
push dword [ebp - 8]
call edi
cmp eax, esi
je 0x1004750
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x20]
push 0x1001d68
jmp 0x1004700
mov dword [ebp - 0x18], esi
jmp 0x1004715
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x18]
jmp 0x1004776
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01003760
leave
ret 4
Function at 0x1004d01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x1004d72
xor ecx, ecx
cmp cx, word [eax]
je 0x1004d72
push edi
push esi
push eax
call fcn.010043d6
mov edi, eax
cmp edi, esi
je 0x1004d6d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1004d3b
test al, 0x10
je 0x1004d3b
inc ebx
jmp 0x1004d56
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x1004d4e
mov esi, 0x10b
cmp esi, 2
jne 0x1004d56
push 3
pop esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
pop edi
jmp 0x1004d7c
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100020b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.10001e25
bound esp, qword [esi - 0x57ba72a2]
push eax
call fcn.10001e35
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.10001dea
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x10002113
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
invalid
inc ebp
Function at 0x10004f70
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x9c
mov eax, dword [0x10009040]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, ecx
mov dword [esp + 4], edx
test esi, esi
jne 0x10004fa7
xor eax, eax
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.10003c4d
add esp, 0x9c
ret
push ebx
push ebp
push edi
push 0x64
lea eax, [esp + 0x48]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyExA]
add esp, 0xc
test byte [esi], 8
mov eax, dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, dword [sym.imp.USER32.dll_CharUpperBuffA]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffA]
je 0x10005030
push 0
call eax
push eax
push 0
push 0x11
call ebp
push 0x19
lea ecx, [esp + 0x18]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 1
lea eax, [esp + 0x18]
push eax
call edi
push 0x18
lea eax, [esp + 0x19]
push eax
call ebx
lea eax, [esp + 0x14]
mov edx, 0x64
push eax
lea ecx, [esp + 0x48]
call fcn.100011f0
push 0x1000731c
mov edx, 0x64
lea ecx, [esp + 0x48]
call fcn.100011f0
mov eax, dword [sym.imp.USER32.dll_GetKeyboardLayout]
test byte [esi], 0x10
je 0x10005089
push 0
call eax
push eax
push 0
push 0x12
call ebp
push 0x19
lea ecx, [esp + 0x18]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 1
lea eax, [esp + 0x18]
push eax
call edi
push 0x18
lea eax, [esp + 0x19]
push eax
call ebx
lea eax, [esp + 0x14]
mov edx, 0x64
push eax
lea ecx, [esp + 0x48]
call fcn.100011f0
push 0x10007320
mov edx, 0x64
lea ecx, [esp + 0x48]
call fcn.100011f0
test byte [esi], 4
je 0x100050e6
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push 0x10
call ebp
push 0x19
lea ecx, [esp + 0x18]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push 1
lea eax, [esp + 0x18]
push eax
call edi
push 0x18
lea eax, [esp + 0x19]
push eax
call ebx
lea eax, [esp + 0x14]
mov edx, 0x64
push eax
lea ecx, [esp + 0x48]
call fcn.100011f0
push 0x10007324
mov edx, 0x64
lea ecx, [esp + 0x48]
call fcn.100011f0
test byte [esi], 1
movzx eax, word [esi + 2]
je 0x10005117
push 0x14
lea edx, [esp + 0x34]
mov ecx, eax
call fcn.100051a0
add esp, 4
test eax, eax
je 0x1000513f
push 1
lea eax, [esp + 0x34]
push eax
call edi
push 0x13
lea eax, [esp + 0x35]
push eax
call ebx
jmp 0x1000512c
push eax
push 0x10007328
lea eax, [esp + 0x38]
push 0x14
push eax
call fcn.10002150
add esp, 0x10
lea eax, [esp + 0x30]
mov edx, 0x64
push eax
lea ecx, [esp + 0x48]
call fcn.100011f0
mov edx, dword [esp + 0xb0]
lea eax, [esp + 0x44]
mov ecx, dword [esp + 0x10]
push eax
call fcn.10001180
mov ecx, dword [esp + 0xa8]
mov eax, 1
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
call fcn.10003c4d
add esp, 0x9c
ret
Function at 0x100051a0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0
mov edi, edx
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
add esi, 0xffffffdf
cmp esi, 0xd
ja case.0x100051c7.41
movzx ecx, byte [esi + 0x100051f4]
jmp dword [ecx*4 + 0x100051ec]
or eax, 0x100
push dword [esp + 0xc]
shl eax, 0x10
push edi
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
neg eax
pop edi
sbb eax, eax
neg eax
pop esi
ret

Function at 0x403104
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40da63
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404ac0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
mov edi, eax
cmp edi, 0x104
jbe 0x40da86
mov eax, edi
add eax, eax
call fcn.00402e24
mov esi, eax
jmp 0x40da88
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.00406a9c
push edi
push esi
call fcn.00406b34
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40dac1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40daab
mov eax, esp
cmp esi, eax
je 0x40dace
mov eax, esi
call fcn.00402e40
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40db08
cmp bl, 0
je 0x40db04
cmp bl, 0x41
jl 0x40daff
cmp bl, 0x5a
jg 0x40daff
or bl, 0x20
xor al, bl
inc esi
jmp 0x40dae3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40da48

Function at 0x40f6e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd98
mov eax, esi
mov edx, 8
test al, 1
je 0x40f700
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f702
shr eax, 1
dec edx
jne 0x40f6f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f6ec
pop esi
ret

Function at 0x40f72f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd94], 0
jne 0x40f73b
call fcn.0040f6e4
push 1
push 0x41cd94
call fcn.00406948
mov eax, edi
test esi, esi
je 0x40f766
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd98]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40f741
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xe3f628
Capabilities:
Encode data using xor

Disassembly:
cdq
popal
sbb dword [esp + ecx*8], 0x14
and byte [ebx + 0x8eb7437], 0
jmp 0xe3f632
add byte [esi + 4], bh
jmp 0xe3f632
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
pushal
call 0xe3f638
pop ebp
sub ebp, 0x10
sub ebp, 0xa3f628
jmp 0xe3f64e
mov eax, 0xa3f628
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a1
mov edx, 0xa6f3eb69
mov eax, dword [0xba000005]
imul ebp, ebx, 0x1030a6f3
xor byte [eax], dl
inc eax
dec ecx
jne 0xe3f665
jmp 0xe3f678
loop 0xe3f61e
loop 0xe3f65c
push ebp
imul ebp, dword [ecx + 0x69], 0x6991a8e8
imul ebp, dword [ecx + 0x6a], 0x696dd1a4
imul ebp, dword [ecx - 0x2d], 0x69696941
call 0x6a4d882d
imul ebp, dword [edx - 0x5c], 0x69696dd1
imul edx, ebx, 0x69696941
sahf
mov ebp, dword [edx - 0x5f]
loop 0xe3f680
imul ebp, dword gs:[ecx + 0x69], 0x3939ac6a
add dword [0x169488d], ebx
fnstsw word [eax - 0x15]
imul ebp, dword [eax + 0x45], 0xcaeb014d
pop esi
sbb eax, 0x69696c81
imul eax, dword [eax + 0x6969695f], 0x954d0de4
loopne 0xe3f707
dec ebp
in al, 5
dec ebp
imul esp, edx, 0x696961ec
imul esp, edx, 0x696965fc
imul esp, edx, 0x696979e4
imul ebp, dword [eax + 0x6b586b80], 0x206dabea
in al, dx
popfd
xchg esi, eax
xchg esi, eax
xchg esi, eax
loop 0xe3f72f
dec ebp
in al, 0xd
dec ebp
insd dword es:[edi], dx
stosd dword es:[edi], eax
imul esp, edx, 0x696d4de5
imul ebp, dword [ecx + 1], 0x69488d1d
add ebp, ebx
js 0xe3f6ed
insd dword es:[edi], dx
imul ebp, dword [ecx + 0x69], 0x488d1d01
imul eax, dword [ecx], 0x69eb78dd
push 0x81384d45
insb byte es:[edi], dx
imul ebp, dword [eax + 0x45], 0x6c81384d
sub dword [ecx + ebp*2 + 0x69], 0x6b5a8069
imul ebp, dword [ecx + 0x3c], 0x1c96343d
xchg esi, eax
sbb al, 0x61
or dword [edi], 0xe2696969
aam 0x61
imul ebp, dword [ecx + 0x69], 0x696b5a80
imul edi, dword [edi + 0x651c9634], 0x81611c96
punpckhwd mm5, qword [ecx + 0x69]
loop 0xe3f6f5
popal
imul ebp, dword [ecx + 0x69], 0xbb5aa05a
ljmp 0x27ed
daa
imul ebp, dword [ecx + 0x69], 0x6921e166
imul ebp, dword [ecx + 0xf], 0xe95075e2
xchg edx, eax
and dword [esi - 0x13], 0x69696973
jmp 0xee4a77dd
Function at 0x40ba68
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49e390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov word [ebp - 0x1c], 0x2f
mov word [ebp - 0x1a], 0x2f2f
mov word [ebp - 0x18], 0x2f22
mov word [ebp - 0x16], 0x3a
mov word [ebp - 0x14], 0x2a
mov word [ebp - 0x12], 0x3f
mov word [ebp - 0x10], 0x3c
mov word [ebp - 0xe], 0x3e
mov word [ebp - 0xc], 0x7c
mov word [ebp - 0xa], 0x2f74
mov word [ebp - 8], 0x22
xor esi, esi
movzx eax, word [ebp + esi*2 - 0x1c]
push eax
push edi
call fcn.0045fe7f
test eax, eax
pop ecx
pop ecx
jne 0x40bae4
inc esi
cmp esi, 0xb
jb 0x40babd
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045eaa1
leave
ret
xor al, al
jmp 0x40bad7

Function at 0x41a0a9
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
push 0xfffffffffffffffe
pop eax
jbe 0x41a0cf
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x488800]
inc ecx
dec edx
jne 0x41a0b2
pop edi
pop esi
ret

Function at 0x41a0d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
xor ecx, ecx
cmp dword [esp + 8], eax
jbe 0x41a0fb
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x4a0568]
inc ecx
cmp ecx, dword [esp + 8]
jb 0x41a0da
ret

Function at 0x41a52c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
call fcn.0041a0a9
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], edx
mov esi, eax
jle 0x41a55e
lea eax, [edx + esi]
and eax, 0x3ff
mov al, byte [eax + 0x4a92e0]
xor byte [ecx], al
inc ecx
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x41a547
mov eax, esi
pop esi
pop ebp
ret

Function at 0x41a563
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
test edx, edx
jle 0x41a588
push ebx
push edi
lea edi, [ecx + esi]
and edi, 0x3ff
mov bl, byte [edi + 0x4a92e0]
xor byte [eax], bl
inc eax
inc ecx
cmp ecx, edx
jl 0x41a56f
pop edi
pop ebx
mov ecx, dword [esp + 4]
call fcn.0041a0a9
sub eax, esi
neg eax
sbb eax, eax
inc eax
ret

Function at 0x41be85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, ebx
mov ecx, edi
call fcn.0041a0a9
mov dword [ebp - 4], eax
xor eax, eax
test ebx, ebx
jbe 0x41bec0
mov esi, dword [ebp + 0xc]
add esi, 0x523
mov ecx, esi
and ecx, 0x3ff
mov cl, byte [ecx + 0x488800]
xor byte [eax + edi], cl
inc eax
inc esi
cmp eax, ebx
jb 0x41bea9
xor esi, esi
test ebx, ebx
jbe 0x41beed
xor edx, edx
push 7
pop ecx
mov eax, esi
div ecx
mov bl, byte [esi + edi]
inc edx
mov ecx, edx
and ecx, 0x80000007
jns 0x41bee2
dec ecx
or ecx, 0xfffffff8
inc ecx
rol bl, cl
mov byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 8]
jb 0x41bec6
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x41bef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x41bf26
push 7
xor edx, edx
pop ecx
mov eax, esi
div ecx
mov bl, byte [esi + edi]
sub ecx, edx
and ecx, 0x80000007
jns 0x41bf1b
dec ecx
or ecx, 0xfffffff8
inc ecx
rol bl, cl
mov byte [esi + edi], bl
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x41bf00
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
jbe 0x41bf4f
mov ecx, dword [ebp + 0x10]
add ecx, 0x523
mov esi, ecx
and esi, 0x3ff
mov bl, byte [esi + 0x488800]
xor byte [eax + edi], bl
inc eax
inc ecx
cmp eax, edx
jb 0x41bf38
mov ecx, edi
call fcn.0041a0a9
sub eax, dword [ebp + 8]
pop esi
neg eax
sbb eax, eax
inc eax
pop ebx
pop ebp
ret
Function at 0x42f76a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48264d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x49e390]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.00432a05
call dword [0x484208]
mov dword [esp + 0x10], eax
jmp 0x42f7cf
xor esi, esi
mov ebx, dword [0x484208]
call ebx
sub eax, dword [esp + 0x10]
cmp eax, 0x3e8
jb 0x42f7f4
call ebx
cmp dword [ebp + 8], esi
mov dword [esp + 0x10], eax
je 0x42f7f4
mov ecx, edi
call fcn.004301da
mov eax, dword [edi + 0x108]
cmp eax, esi
mov ecx, dword [edi + 0x104]
je 0x42f87a
cmp eax, 0xffffffff
je 0x42f87a
cmp ecx, esi
push 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
pop eax
je 0x42f81d
cmp ecx, 0xffffffff
jne 0x42f820
xor eax, eax
inc eax
push 1
push 0x64
push esi
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [0x48412c]
cmp eax, esi
je 0x42f87a
cmp eax, 1
jne 0x42f7cf
cmp dword [esp + 0x20], esi
je 0x42f84a
push dword [esp + 0x20]
call fcn.0045ea9c
pop ecx
cmp dword [esp + 0x30], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
je 0x42f866
push dword [esp + 0x30]
call fcn.0045ea9c
pop ecx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [edi + 0x140]
push eax
call dword [0x484310]
lea esi, [edi + 0x114]
mov ebx, esi
lea eax, [esp + 0x2c]
call fcn.0043291f
call fcn.00432b42
lea esi, [edi + 0x124]
mov ebx, esi
lea eax, [esp + 0x1c]
call fcn.0043375a
call fcn.0043389e
lea eax, [edi + 0x140]
push eax
call dword [0x484330]
lea eax, [esp + 0x2c]
call fcn.00432acd
mov esi, eax
test esi, esi
je 0x42f8ed
ja 0x42f8d6
call fcn.0045fb07
test esi, esi
jle 0x42f8ed
mov ebx, dword [esp + 0x30]
mov edx, ebx
mov ecx, edi
call fcn.00431c24
add ebx, 0x68
dec esi
jne 0x42f8de
cmp dword [esp + 0x20], 0
je 0x42f7cd
mov esi, dword [esp + 0x24]
sub esi, dword [esp + 0x20]
sar esi, 6
je 0x42f7cd
test esi, esi
ja 0x42f914
call fcn.0045fb07
test esi, esi
jle 0x42f7cd
mov ebx, dword [esp + 0x20]
mov edx, ebx
mov ecx, edi
call fcn.004318a0
add ebx, 0x40
dec esi
jne 0x42f91e
jmp 0x42f7cd

Function at 0x43907e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push eax
push eax
call fcn.004630c2
add esp, 0x18
leave
ret
Function at 0x439529
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
mov edi, eax
call fcn.004397b8
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040d85f
mov eax, dword [ebp - 4]
pop ecx
xor edx, edx
pop ecx
mov ecx, 0x14b
div ecx
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x43956a
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x43955d
pop edi
leave
ret

Function at 0x43956d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 4
push dword [ebp + 0xc]
mov edi, eax
lea eax, [ebp - 4]
push eax
call fcn.0040d884
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 0x14b
div ecx
add esp, 0xc
xor eax, eax
inc dl
cmp dword [ebp + 8], eax
jbe 0x4395a7
mov cl, al
add cl, dl
xor byte [eax + edi], cl
inc eax
cmp eax, dword [ebp + 8]
jb 0x43959a
push dword [ebp + 8]
call fcn.004397b8
pop ecx
xor ecx, ecx
cmp dword [ebp - 4], eax
pop edi
sete cl
mov al, cl
leave
ret

Function at 0x4397b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor edx, edx
push 0xa
pop ebx
div ebx
or esi, 0xffffffff
xor ecx, ecx
mov edx, 0xff
test eax, eax
mov dword [ebp - 4], eax
jbe 0x439805
xor eax, eax
cmp ecx, 0xa
jae 0x439805
mov ebx, dword [ecx*4 + 0x4883d0]
add ebx, eax
movzx ebx, byte [ebx + edi]
xor ebx, esi
and ebx, edx
shr esi, 8
xor esi, dword [ebx*4 + 0x487fd0]
inc ecx
add eax, 0xa
cmp ecx, dword [ebp - 4]
jb 0x4397dc
cmp dword [ebp + 8], 0
je 0x439828
mov eax, edi
movzx ecx, byte [eax]
dec dword [ebp + 8]
xor ecx, esi
and ecx, edx
shr esi, 8
xor esi, dword [ecx*4 + 0x487fd0]
inc eax
cmp dword [ebp + 8], 0
jne 0x43980d
mov eax, esi
pop esi
not eax
pop ebx
leave
ret

Function at 0x439830
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret