joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e8465
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x4c]
xor edi, dword [edx*4 + 0x8c62d0]
rcl dx, cl
jmp 0x8e847f
mov byte [esp + 0x1e], ah
pop dword [esp]
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x8e83e2
mov edx, dword [edx*4 + 0x8c52d0]
cmc
and edx, ecx
pushal
jmp 0x8e83fa
lea esp, [esp + 2]
jmp 0x8e8411
and edx, ecx
sub esp, 4
sub esp, 0x1e
jmp 0x8e8431
mov edi, edx
call 0x8e845c
inc edi
shr edi, 0x18
call 0x8e8465
out dx, al
push word [esp + 1]
lea esp, [esp + 5]
jmp 0x8e84d0
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x8c52d0]
jmp 0x8e8454
and edi, ecx
mov edi, dword [edi*4 + 0x8c56d0]
push esp
push word [esp + 1]
jmp 0x8e84fd
lea esp, [esp + 1]
mov edi, dword [edi*4 + 0x8c52d0]
push edx
add esp, 3
lea esp, [esp + 1]
jmp 0x8e84b2
mov bl, 0x34
mov bx, 0x641
setg bl
jmp 0x8e855f
lea esp, [esp + 2]
and ebx, ecx
lea esp, [esp + 8]
xor edi, dword [ebx*4 + 0x8c5ed0]
jmp 0x8e84e5
movzx ebx, byte [esi + 0xa]
call fcn.008e8536
sbb dword [ecx], 0xa61be889
loope 0x8e85ea
call 0xdc530004
xor ch, byte [0xe810c183]
and edi, esi
invalid
mov dword [esi + 8], edi
jmp 0x8e866c
lea edi, [edi + 0x8c52d0]
mov ebx, dword [edi]
pop edi
jmp 0x8e86b0
push edi
mov edi, ebx
lea edi, [edi*4]
jmp 0x8e8650
lea edx, [edx*4]
lea edx, [edx + 0x8c56d0]
mov edi, dword [edx]
pop edx
jmp 0x8e8695
and edi, ecx
push edx
mov edx, edi
jmp 0x8e8678
and ebx, ecx
lea esp, [esp + 0x40]
xor edi, dword [ebx*4 + 0x8c5ed0]
push edx
jmp 0x8e8706
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x8c52d0]
jmp 0x8e868e
neg bl
mov byte [esp + 1], ah
xchg bl, bh
lea esp, [esp + 4]
movzx ebx, byte [esi + 0xe]
call fcn.008e86ed
and edx, ecx
call fcn.008e87a9
rcr byte [ecx - 0x37], 1
test al, 0x5b
out dx, eax
xor bh, byte [edx + 0xdba4f28]
sbb esi, dword [edx + 0x6d]
pop word [esp + 0x11]
push dword [esp + 0x12]
pop word [esp + 0x11]
lea esp, [esp + 2]
jmp 0x8e871b

Function at 0x8e85db
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x8e8609
mov edx, dword [esi + 0xc]
stc
stc
stc
pushal
jmp 0x8e85ea
push dword [esp + 2]
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + 0x8c62d0]
mov dh, byte [esp]
pushal
jmp 0x8e85dd

Function at 0x8e86ed
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
push esp
pop word [esp]
push word [esp + 1]
jmp 0x8e86ef
mov ebx, dword [ebx*4 + 0x8c52d0]
sub esp, 2
sub esp, 6
cmc
pushal
jmp 0x8e86be
jmp 0x8e86d6
mov edx, dword [edx*4 + 0x8c52d0]
pushal
jmp 0x8e874f
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + 0x8c5ad0]
sub esp, 0x1a
jmp 0x8e8731

Function at 0x8e87e2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x8e87e4
jmp 0x8e87c8
lea esp, [esp + 8]
jne 0x8bb04e
je 0x8bb07e
jp fcn.008e87e2
bound eax, qword [0xf96c35f4]
imul ecx, dword [eax], 0xbb584ffb
xchg edx, eax
or eax, 0x24648d9c
lea esp, [esp + 4]
jmp 0x8e8577
lea esp, [esp + 0xc]
Function at 0x8f06fc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, byte [esp + 3]
jmp 0x8f0706
push dword [esp + 2]
lea esp, [esp + 8]
xor dl, 0x23
inc cl
jnp 0x8f072d
lea ecx, [edx*4]
sub ch, ah
call fcn.008f07a5
movsd dword es:[edi], dword [esi]
aam 0x73
sub dh, ch
jmp 0x8f07f8
lea ecx, [edx*4]

Function at 0x8f0732
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esi
inc cl
jnp 0x8f07c2
mov ch, bh
mov ecx, dword [esp + 1]
jmp 0x8f07c4

Function at 0x8f09b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, ch
xchg ecx, edx
lea edx, [esp + edx]
mov ch, 0x3e
mov edx, 0xad5d0370
xchg dword [esp], edi
jmp 0x8f09b9
jmp 0x8f099e
lea edx, [esp + ebx]
lea edx, [eax - 0x41]
mov ecx, dword [esp]
lea edx, [esi*4]
mov edx, dword [esp]
lea edi, [edi - 0x29]
call fcn.008f09fc
sbb esi, dword [edx + 0x6d]
jl 0x8f0a4f
dec edx

Function at 0x9d80d3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, sp
pop word [esp + 0xc]
mov bl, 0x28
xchg byte [esp + 0xe], cl
jmp 0x9d8140
lea ecx, [edx + esi]
push word [esp + 3]
sub esp, 0x12
jmp 0x9d80bc
pop dword [esp + 0xe]
lea edi, [ebp + 0x74b99ca7]
lea esp, [esp + 2]
mov bl, bh
rdtsc
add esp, 4
jmp 0x9d8222
pop bx
pop dword [esp + 0x10]
mov al, ah
btc ecx, edi
lea esp, [esp + 5]
pop cx
jmp 0x9d81b4
bswap ebx
mov esi, eax
mov bx, 0x792b
pop cx
push dword [esp + 2]
push dword [esp + 0xa]
jmp 0x9d8179
lea edx, [ecx + ebx]
mov di, bx
lea edx, [ebx + ebx]
rcr ebp, 0x15
cpuid
lea ecx, [ecx - 0x5d0a4595]
jmp 0x9d8209
rcr ebx, 0xf
setl dh
mov ecx, 0xcae85486
xchg dword [esp + 2], eax
sub esp, 0x14
clc
jmp 0x9d81a0
mov edi, dword [esp + 9]
xchg edx, eax
rcr edx, 0x11
btr eax, esp
push word [esp + 5]
bsf bx, si
jmp 0x9d828b
xchg byte [esp + 6], dl
lea esp, [esp + 7]
pop dword [esp + 2]
mov byte [esp + 6], ch
jmp 0x9d81ec
pop eax
lea ebp, [esi*4]
xchg byte [esp + 2], bl
setg ch
add esp, 1
mov bl, bh
jmp 0x9d81d7
and cl, bh
rdtsc
inc edi
mov al, ah
btc ecx, edi
call fcn.009d8262
and esp, dword [ecx + 0x40a35031]
pushal
mov dword [0xc48335da], eax
add byte [ebp + 0x310fd15d], cl
add esp, 0
lea ebx, [ebp - 0x2f]
rdtsc
not cx
xchg bh, cl
not ecx
jmp 0x9d8238
not ah
xchg word [esp + 9], bx
neg ch
mov ebp, 0x1c598526
add esp, 0xb
lea esp, [esp]
jmp 0x9d8251
Function at 0x9d8262
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], esi
jmp 0x9d826b
mov ebx, ecx
inc di
not cx
rol bp, cl
xchg word [esp + 2], bp
pop ebx
jmp 0x9d82a1
mov ax, word [esp]
mov bp, word [esp]
xchg ecx, ebx
add esp, 0
not bh
neg si
jmp 0x9d8922
mov al, ah
rol bp, cl
cpuid
mov bp, word [esp + 2]
mov ebp, dword [esp]
add esp, 2
call 0x9d82f3
sub esp, 0xe
pop ebx
setns dh
popal
bswap ebp
mov bp, word [esp + 2]
jmp 0x9d8311
bswap ebx
shr ecx, 1
mov bh, byte [esp + 0xb]
setge ch
not edi
inc esi
jmp 0x9d83b8
rdtsc
mov cl, ch
mov edx, ebp
mov cx, word [esp]
inc eax
sub esp, 0x18
jmp 0x9d83f7
neg edi
mov edi, 0x95ab199a
lea ebp, [edx + ebp]
mov byte [esp], ch
inc cx
rol di, cl
jmp 0x9d8479
mov al, 0x5e
stc
xchg byte [esp], bl
mov byte [esp], ch
rdtsc
xchg ah, bl
jmp 0x9d84b7
add esp, 0
btr edx, edx
mov cl, 0x72
add esp, 0
mov bh, 0xc3
bswap ebp
jmp 0x9d85ce
mov edi, 0x5bae1150
neg dh
setp ch
inc bl
not dx
bswap edi
jmp 0x9d868c

Function at 0x9d8751
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 6]
push word [esp + 3]
xchg dword [esp + 8], edx
push esp
jmp 0x9d8639
jmp 0x9d8586
btr eax, edx
mov ax, 0x9fb3
pop di
mov bp, word [esp + 0xc]
call 0x9d85f4
pop edi
mov ebx, dword [esp + 0x11]
mov bh, byte [esp + 5]
jmp 0x9d8620
mov dword [esp + 0xb], ecx
xchg word [esp + 0xd], si
xchg bx, ax
bswap ecx
push dword [esp + 0xa]
pop bx
jmp 0x9d85e0
xchg word [esp + 3], dx
xchg byte [esp], cl
xor edx, esi
mov bl, 0x60
mov ch, byte [esp + 0xd]
btc ebp, ebx
jmp 0x9d8664
mov word [esp + 2], bx
pop si
pop si
xchg edx, eax
add esp, 1
cpuid
jmp 0x9d860a
xchg byte [esp + 0xa], al
mov word [esp + 0x28], bx
lea ebx, [esp + edi]
lea ebx, [ecx - 0x3b]
xchg dword [esp + 0x2e], edi
jmp 0x9d86e2
xor bx, 0xff6c
mov dh, byte [esp + 7]
pushal
xchg ch, dl
sub bl, ah
mov edx, 0x9eac4944
jmp 0x9d864b
mov dl, 0x14
xchg di, bx
lea esi, [ebp - 0xd7]
cpuid
pop ax
jmp 0x9d8793
setne ah
rdtsc
lea esp, [esp + 5]
lea esi, [ecx*4]
mov di, word [esp + 0x11]
xchg byte [esp + 8], bl
jmp 0x9d86a0
rdtsc
pop word [esp + 0x29]
mov bh, byte [esp + 7]
lea edi, [esp + edx]
lea esi, [ecx + 0x33]
mov word [esp + 0x1a], sp
jmp 0x9d86b6
rol si, cl
mov dword [esp + 0x21], eax
mov ecx, eax
push dword [esp + 0x1e]
sub esp, 0x1c
lea esp, [esp + 0x49]
call fcn.009d871b
xchg byte [esp], cl
lea ebp, [ecx*4]
mov dword [esp + 3], esi
lea esp, [esp + 1]
jmp 0x9d8857
pop dword [esp + 1]
xchg ebp, ecx
inc bl
mov byte [esp + 0x27], ch
bsf dx, ax
mov bp, 0x1455
jmp 0x9d8738
clc
mov ebx, 0xad26061a
mov bl, bh
inc edx
lea ebp, [ecx + 0x1c355733]
jmp 0x9d8833
pop word [esp + 0xc]
neg bx
xchg bx, ax
btc ebx, edi
pop ebx
lea esp, [esp + 0x1d]
jmp 0x9d87a9
cpuid
mov dl, 0x5c
call fcn.009d87f0
out dx, eax
jg 0x9d8842
jmp 0x969e1549
lea eax, [ebp*4]
lea esp, [esp + 1]
lea eax, [edx + ebx]
setae bh
lea edx, [ebp*4]
btr ebp, edx
jmp 0x9d881b
xchg ebx, eax
invalid
mov di, 0x6df3
pushal
rdtsc
mov ah, byte [esp]
rdtsc
pop word [esp + 0x14]
jmp 0x9d87c3
Function at 0x9d8886
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], bx
pushal
add esp, 0x21
bsf ax, ax
push word [esp + 1]
jmp 0x9d888a
xchg ah, bl
jmp 0x9d886d
add esp, 5
cmc
xchg bh, cl
xchg di, dx
sub esp, 0
clc
jmp 0x9d88f4
lea ecx, [ebp - 0x97]
call fcn.009d88d6
mov word [esp], dx
xchg ecx, esi
rdtsc
push word [esp + 4]
cpuid
xchg ecx, esi
jmp 0x9d8a39
neg bp
push esp
btc edi, ebx
mov word [esp], di
pop bx
xchg bp, bx
jmp 0x9d89b0
mov edx, ecx
bsr di, cx
lea ebx, [edi + edi]
push dword [esp + 0xb]
push dword [esp + 7]
xchg esi, edx
jmp 0x9d8960
pop word [esp + 7]
mov byte [esp + 5], dh
mov ch, byte [esp + 6]
inc ebx
mov byte [esp + 1], bh
bsr dx, bp
jmp 0x9d8977
xchg ebx, edi
mov dh, byte [esp + 6]
mov word [esp + 5], sp
mov bp, word [esp + 8]
mov ebp, esi
jmp 0x9d8a03
push dword [esp + 7]
xchg dword [esp], ecx
mov edi, 0x1cccc8a2
xchg byte [esp + 0xa], dl
btr ebp, edx
push word [esp + 8]
jmp 0x9d8998
pushal
mov bl, 0x88
bswap ecx
mov eax, 0xedc9ca14
mov ah, byte [esp + 6]
mov dword [esp + 0x1a], ecx
jmp 0x9d8a85
btc edi, ebx
xchg word [esp + 0x12], ax
mov al, 0xe
xchg byte [esp + 0x10], bl
mov dl, 0x3c
neg ebp
jmp 0x9d89e4
pop bp
mov si, 0x5d6b
inc bl
stc
cmc
inc bl
jmp 0x9d89ca
xchg dword [esp], ebx
mov cl, ch
xchg ch, dl
push word [esp + 5]
push word [esp + 2]
add si, 0x89d6
jmp 0x9d8a1f
mov bh, byte [esp + 3]
pop di
mov ah, byte [esp + 1]
setge bh
xchg byte [esp], dl
setge ah
jmp 0x9d8aee
clc
xchg dword [esp], eax
mov byte [esp + 1], dh
mov bl, bh
pop ax
xchg dh, al
jmp 0x9d8a51
add esp, 0x1a
add esp, 0
mov byte [esp + 3], ah
add esp, 0x15
lea esi, [eax*4]
inc ax
jmp 0x9d8a6e
mov byte [esp + 5], bh
cmc
btc ecx, edi
mov ah, byte [esp + 9]
mov cl, 2
add esp, 0xf
jmp 0x9d8ce3
rdtsc
mov esi, 0xdc481b60
lea ebx, [eax + 0x89]
mov ecx, esi
lea eax, [ebx + ebp]
jmp 0x9d8a9d
mov eax, 0x73c88b16
lea ecx, [eax - 0xe9]
lea edi, [edx + esi]
pop si
sub esp, 0xe
cmc
jmp 0x9d8abb
lea ecx, [edi*4]
mov edi, 0xd1be63b0
btc ecx, ebx
mov ebp, esi
jmp 0x9d8ad4
neg edi
lea ecx, [ecx*4]
cmc
lea edx, [esi + 0x790e5dfd]
call fcn.009d8b70
mov edi, dword [esp + 4]
mov byte [esp + 0xd], bh
pop cx
mov dword [esp + 4], ecx
lea ebx, [ecx*4]
mov dword [esp + 0xa], eax
jmp 0x9d8c03
lea esp, [esp]
cpuid
sub esp, 0x12
mov dl, 0x1c
mov dword [esp + 3], eax
pop word [esp]
jmp 0x9d8c48

Function at 0x9d88d6
Capabilities:
Execute anti-debugging instructions

Disassembly:
btc ebx, ebx
mov esi, dword [esp + 1]
xchg dh, al
mov ecx, dword [esp + 2]
shr ecx, 0x1f
jmp 0x9d88ff
Function at 0x9d8b42
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, dword [esp + 0xe]
add esp, 0x1a
bsr bx, cx
jmp 0x9d8bbe
inc ecx
bsf ax, si
mov eax, ebp
call fcn.009d8b78
mov byte [esp + 1], ah
lea esp, [esp + 2]
mov byte [esp], ch
lea edx, [ebx + esi]
mov ch, byte [esp]
xchg dh, al
jmp 0x9d8beb
lea eax, [ebp*4]
mov ebx, dword [esp]
mov ebp, dword [esp]
mov edi, eax
mov byte [esp], bh
neg dh
jmp 0x9d8b95
mov bx, word [esp]
lea edx, [ebp - 0x6f]
add esp, 0
sub esp, 8
sub esp, 2
jmp 0x9d8c2e
neg bh
bsr bp, cx
bswap edx
mov byte [esp], ch
xchg byte [esp], bl
mov ecx, esi
jmp 0x9d8bd4
shr dh, 7
bsr cx, bp
mov eax, 0xdce8b2e
mov word [esp], dx
jmp 0x9d8cab
rdtsc
pop cx
pop ecx
pop word [esp]
mov al, 0x96
xchg dx, di
jmp 0x9d8c18
push esp
call fcn.009d8c88
rdtsc
cpuid
xchg bp, ax
xchg bh, cl
push word [esp + 8]
jmp 0x9d95c4
add esp, 4
lea esp, [esp + 1]
lea esp, [esp + 0xc]
popal
clc
clc
jmp fcn.009d90f7
push dword [esp + 7]
xchg ch, dl
xchg word [esp + 0xb], di
xchg byte [esp + 8], al
mov di, word [esp + 0xb]
bsr di, bp
jmp 0x9d9556

Function at 0x9d8b78
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
pop di
btc edi, edi
jmp 0x9d8ba1

Function at 0x9dadcc
Capabilities:
Get number of processors
Parse pe header

Disassembly:
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp]
jmp 0x9dadb5

Function at 0x9daedd
Capabilities:
Get number of processors
Parse pe header

Disassembly:
mov dword [esp + 1], ebp
pop word [esp + 1]
push word [esp + 1]
push word [esp + 1]
mov byte [esp + 7], bh
jmp 0x9daec5

Function at 0x40699a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448574], 0
push esi
jne 0x4069d1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4069ab
mov dword [ecx*4 + 0x448570], eax
inc ecx
cmp ecx, 0x100
jl 0x4069a6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448570]
xor eax, esi
inc ecx
dec edx
jne 0x4069e4
pop edi
not eax
pop esi
ret 0xc
Function at 0x401c77
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401e27
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x401d75
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401d18
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401d5b
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401d2f
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401d4a
test al, 0x40
je 0x401d41
mov ecx, dword [edi + 0x20]
jmp 0x401d48
test al, 0x80
je 0x401d5b
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401d5b
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401ce7
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x408497
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4084b5
mov eax, 0x540aca
push eax
push 1
mov ebx, 0x44c830
call fcn.0044c25c
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4084df
mov eax, 0
jmp 0x408553
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x408540
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x408529
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x408518
xor ecx, eax
xor edx, ebx
dec edi
jne 0x408509
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x40e317
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40e338
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x40e32f
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40e327
mov eax, ebx
leave
ret

Function at 0x40e35e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 8]
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 8]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x40e3bd
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40e3ea
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40e3d9
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40e3ca
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x40e410
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x40e3b1
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x41f4fd
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x41f51f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.OLEAUT32.dll_SysStringLen
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.OLEAUT32.dll_SysStringLen
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x41f65a
mov esp, ebp
pop ebp
ret

Function at 0x4213d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x4213f7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0x2b7e9735
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x421470
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x4214be
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8
Function at 0x4214ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
jmp 0x4214df
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push esi
xor esi, esi
nop
mov eax, reloc.OLEAUT32.dll_SysStringLen
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x354e7978
mov eax, reloc.OLEAUT32.dll_SysStringLen
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x836bd0f7
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x422bc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x422be8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
mov dword [ebp - 4], 0x2ec3d7e5
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, dword [ebp - 4]
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x422c61
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x422caf
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8