joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47041f
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0047039b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x47058e
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x47058e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x470543
jg 0x47047b
test eax, eax
je 0x470539
push 1
push 0x1000
call fcn.0046a070
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x47049e
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x470530
push 0x8000
push ebx
call fcn.00460ea5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4704c7
jg 0x4704c2
cmp ecx, 0x1000
jb 0x4704c7
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0045f4ca
add esp, 0x10
cmp eax, 0xffffffff
je 0x47050c
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4704c2
jl 0x4704f3
test ecx, ecx
jne 0x4704b4
push dword [ebp - 0xc]
push ebx
call fcn.00460ea5
push esi
call fcn.00468c3b
add esp, 0xc
xor ebx, ebx
jmp 0x47059c
cmp byte [edi + 0x24], 0
je 0x470523
cmp dword [edi + 0x20], 5
jne 0x470523
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x47052e
mov ebx, dword [edi + 0x18]
jmp 0x470530
xor ebx, ebx
push esi
call fcn.00468c3b
pop ecx
jmp 0x47059c
test ecx, ecx
jg 0x470505
jl 0x470543
test eax, eax
jae 0x470505
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0045eb82
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x470563
cmp byte [edi + 0x1c], 0
je 0x470505
jmp 0x470594
push ebx
call fcn.00470331
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x470505
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x47059c
cmp byte [edi + 0x1c], 0
je 0x470599
mov ebx, dword [edi + 0x18]
jmp 0x47059c
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0045eb82
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x470ccd
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x499104]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x470d18
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00470e68
test al, al
jne 0x470d12
sub edx, 2
cmp edx, edi
jne 0x470cf8
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x470d3a
lea eax, [edi + 2]
cmp edx, eax
je 0x470d3a
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00470c19
add esp, 0x10
jmp 0x470e34
push esi
lea ecx, [ebp - 0x255]
call fcn.00470e68
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x470d7d
push dword [ebp - 0x25c]
jmp 0x470d2a
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x470dba
cmp word [ebp - 0x226], 0
je 0x470ddb
cmp word [ebp - 0x226], ax
jne 0x470dba
cmp word [ebp - 0x224], 0
je 0x470ddb
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00470c19
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x470e27
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x470d94
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x470e0f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x470e34
push 0x470a49
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00476ea0
add esp, 0x10
jmp 0x470e04
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e446
leave
ret

Function at 0x4717b2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4717c3
pop esi
ret
push ebx
push edi
push esi
call fcn.0047177b
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00468e65
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4717eb
push ebx
push esi
push edi
call fcn.0044d7e0
add esp, 0xc
push 0
call fcn.00468c3b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x471bbb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00471800
Function at 0x473c3f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00468950
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x473cae
cmp esi, dword [ebp - 4]
je 0x473ca9
cmp dword [ebp + 0xc], 0
je 0x473ca9
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x473c86
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00473791
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x473cb0
xor eax, eax
inc eax
jmp 0x473cb0
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x473d15
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x499104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00468950
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00468950
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x473d8c
cmp word [ecx], dx
je 0x473d8c
mov eax, dword [0x4897ac]
push edi
dec eax
push eax
push 0x489698
call fcn.00473cb4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x473dff
cmp word [eax], dx
je 0x473dff
mov eax, dword [edi]
test eax, eax
je 0x473db0
cmp word [eax], dx
je 0x473db0
lea eax, [ebp - 0x10]
push eax
call fcn.00473697
jmp 0x473db9
lea eax, [ebp - 0x10]
push eax
call fcn.00473732
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x473e29
mov eax, dword [0x489694]
push dword [ebp - 0x14]
dec eax
push eax
push 0x489388
call fcn.00473cb4
add esp, 0xc
test al, al
je 0x473e29
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x473df4
cmp word [eax], di
je 0x473df4
lea eax, [ebp - 0x10]
push eax
call fcn.00473697
pop ecx
jmp 0x473e2b
lea eax, [ebp - 0x10]
push eax
call fcn.00473732
jmp 0x473df1
mov eax, dword [edi]
test eax, eax
je 0x473e16
cmp word [eax], dx
je 0x473e16
lea eax, [ebp - 0x10]
push eax
call fcn.0047364c
pop ecx
jmp 0x473e29
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x473ef4
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00473b39
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x473ef4
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x473ef4
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x473ef4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x473e81
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0046b2ad
test ebx, ebx
je 0x473eef
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0046b2ad
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x473ef4
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x473ef4
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0047763a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x473ef6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042e446
leave
ret
Function at 0x4daa9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x1fdefe87
call fcn.004da9a0
lea edx, [ecx + edx]
lea edx, reloc.WININET.dll_InternetSetCookieW
jmp 0x4daabc
neg esi
mov ecx, 0x3be0ebd
push ebp
mov byte [esp + 2], bl
neg ch
jmp 0x4db0d1
bswap ecx
lea edx, [ecx*4]
mov ah, bh
jmp 0x4db042
mov ah, bh
jmp 0x4db042
jmp 0x4daf5f
jp 0x4dafd8
jnp 0x4dafd8
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0x4daf22
add esi, dword [edi]
rdtsc
sub esp, 8
jb 0x4daf20
pop word [esp + 1]
lea esp, [esp + 2]
ror esi, 0
rdtsc
xchg cl, al
lea edx, reloc.WININET.dll_InternetSetCookieW
adc al, bl
jmp 0x4daf3d
jl 0x4daaf5
bswap ecx
lea edx, [ecx*4]
jmp 0x4dab06
mov dh, 0xfe
mov ax, 0x9ff6
jmp 0x4db1e0
bts eax, eax
je 0x4db1f6
mov dh, 0xfe

Function at 0x4daae3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4daaa4
pop edx
rdtsc
cmc
jb 0x4daaba
lea edx, [ecx + edx]
lea edx, reloc.WININET.dll_InternetSetCookieW
jmp 0x4daabc

Function at 0x59afc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
bts ebx, edi
jmp 0x59afac
Function at 0x59b216
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0x41c3ee39
xchg edx, eax
lea eax, reloc.WININET.dll_InternetSetCookieW
mov bx, word [esp + 2]
jmp 0x59b555
add esp, 0
cld
clc
mov bx, 0x465d
mov dl, dh
xchg ah, al
jmp 0x59b2c9
bsf bx, bx
mov dh, 0x2e
lea edx, [esi + edi]
mov ax, dx
xchg byte [esp], bl
mov ah, byte [esp]
jmp 0x59b250
xchg edx, eax
mov dx, bx
mov bl, byte [esp]
cmc
clc
mov bl, byte [esp]
jmp 0x59b266
sub esp, 6
mov dl, bl
pop dx
mov dword [esp], esp
pop dx
setnp al
jmp 0x59b2f0
cmp al, 0xed
xchg dx, ax
mov bx, word [esp]
rol bx, 5
sub ax, sp
mov bl, 0x40
jmp 0x59b28f
bsf ebx, esp
shr dl, cl
xchg byte [esp], bh
not al
bsf eax, eax
mov bl, 0x59
jmp 0x59b2a5
xchg word [esp + 2], bx
setge bh
mov eax, dword [esp + 1]
jmp 0x59b36c
lea eax, reloc.WININET.dll_InternetSetCookieW
pop dx
xchg ebx, edx
push ecx
not bx
rdtsc
jmp 0x59b2da
mov bx, 0x1911
xchg byte [esp + 1], bl
add esp, 3
lea esp, [esp]
mov bh, al
mov dh, byte [esp]
jmp 0x59b281
mov dx, 0xd444
not bx
push word [esp + 2]
rdtsc
jmp 0x59b352
lea ebx, [eax*4]
bsf edx, edi
mov ebx, 0xad76d7d6
setbe ah
mov word [esp + 1], ax
std
jmp 0x59b322
push word [esp + 1]
pop dword [esp]
mov bx, word [esp + 2]
not ax
mov dx, ax
jmp 0x59b4e7
mov dx, word [esp + 4]
lea edx, reloc.WININET.dll_InternetSetCookieW
xchg dl, dh
sete dh
mov byte [esp + 2], dh
mov dword [esp], esp
jmp 0x59b338
mov dh, byte [esp + 0x10]
cld
pushal
xchg ah, dh
sub esp, 0xd
lea esp, [esp + 0x4b]
jmp 0x59b4a0
mov dx, word [esp + 0x11]
std
mov eax, ebp
inc eax
xchg dx, ax
lea eax, reloc.WININET.dll_InternetSetCookieW
jmp 0x59b385
mov dl, byte [esp]
mov al, 0x23
pushfd
rdtsc
rdtsc
push word [esp + 1]
call fcn.0059b3bb
mov dx, 0x75eb
mov eax, dword [esp + 8]
pop eax
add esp, 4
xor bl, 0x6d
jmp 0x59b40e
mov ax, si
mov edx, dword [esp]
inc al
call 0x59b41c
adc dword [esi - 0x48], esp
fldenv [esi - 0x7c2d42f1]
in al, dx
add eax, 0x129e38eb
and bh, 0x12
stc
sbb al, 0x97
pop es
bound edx, qword [ecx + 0x54258a7c]
rdtsc
mov ax, 0x98a2
lea eax, [eax + edx]
setle al
xchg bx, ax
sub esp, 0
jmp 0x59b3d1
lea eax, reloc.WININET.dll_InternetSetCookieW
mov dh, 0x16
bswap eax
cmc
cmc
mov dh, cl
jmp 0x59b438
mov byte [esp], dh
xchg byte [esp + 1], dh
pop eax
inc dx
sub esp, 0x1d
mov ebx, 0x9d79ec48
jmp 0x59b3a8
mov dx, word [esp + 1]
lea eax, [esi + esi]
mov dx, 0xdcbb
not ebx
mov bh, 0x76
mov bx, word [esp + 3]
jmp 0x59b30a
Function at 0x59bc6a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [edi - 0x13]
bswap ebx
add esp, 0x1b
lea ebx, reloc.WININET.dll_InternetSetCookieW
jmp 0x59bc8b
bt ax, cx
xchg word [esp + 0x10], dx
jmp 0x59bc54
mov edx, dword [esp + 9]
push word [esp]
rcr bx, cl
std
pop ax
jmp 0x59bdae
mov edx, dword [esp + 6]
inc dx
lea edx, [esp + edx]
bsr ax, dx
stc
mov dword [esp + 1], edx
jmp 0x59bc75
mov edx, ecx
xchg bl, bh
neg edx
push edx
pop ax
pop ebx
jmp 0x59bd0c
push dword [esp + 1]
lea edx, [eax*4]
pop word [esp + 1]
bsr dx, dx
setae dh
mov word [esp + 2], bp
jmp 0x59bc9f
neg bl
lea eax, [ebx + 0xc6]
rol ebx, 0x14
bsf bx, dx
jmp 0x59bd6d
xchg al, dl
inc edx
not bh
xchg dword [esp], eax
rdtsc
pop ax
jmp 0x59bcdc
mov dword [esp], ecx
bswap eax
lea esp, [esp]
bsr ebx, esp
mov edx, esp
mov bx, word [esp + 3]
jmp 0x59bcf2
mov ax, 0x6f8d
mov bx, 0xf146
pop word [esp]
push word [esp + 1]
pushfd
jmp 0x59bd4e
xchg bx, ax
rdtsc
lea esp, [esp]
mov al, byte [esp + 1]
push word [esp]
rdtsc
jmp 0x59bd20
lea ebx, [esp + 0x8e]
cmc
mov word [esp], ax
bswap edx
pop word [esp + 2]
cld
jmp 0x59bd82
neg dx
setae dh
bts dx, di
shr ax, 0xe
mov bl, bh
mov bx, bp
jmp 0x59bd3a
xchg dx, ax
btr edx, ebx
pop eax
mov word [esp], ax
xchg word [esp], dx
neg ebx
jmp 0x59be07
mov dword [esp], ecx
lea esp, [esp + 3]
lea ebx, [ecx*4]
xchg bh, ah
pushfd
pop eax
jmp 0x59bde0
xchg word [esp + 9], bx
neg al
not bx
lea eax, reloc.WININET.dll_InternetSetCookieW
bsf edx, ecx
add esp, 9
jmp 0x59bcbe
mov bl, 0xce
bswap ebx
setns dh
call fcn.0059be1f
out 0x66, al
hlt
mov dx, word [esp]
xchg bl, al
mov ax, word [esp]
xchg bl, ah
mov dx, 0x1212
mov byte [esp], dh
jmp 0x59bdca
add esp, 1
push edx
lea esp, [esp + 1]
mov bx, si
xchg byte [esp + 2], dh
mov byte [esp + 1], bh
jmp 0x59bd95

Function at 0x59c3b3
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x595ff8
call fcn.00595ffd
pop eax
sub eax, 0x19c057
push eax
jmp 0x595f80
call 0x59c057
jmp 0x59c005
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x59c052
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x59c124
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x59c190
Function at 0x401702
Capabilities:
Accept command line arguments

Disassembly:
push 0x58
push 0x409340
call fcn.00402acc
xor esi, esi
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x68]
push eax
call dword [0x440805c]
push 0xfffffffffffffffe
pop edi
mov dword [ebp - 4], edi
mov al, 0x4d
pop edx
add byte [esi], al
xor dword [0x440002], eax
jno 0x4015ec
mov eax, dword [0x40603c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4015ec
mov ecx, 0x10b
cmp cx, word [eax + 0x400018]
jne 0x4015ec
xor dword [eax], 0x74
add byte [eax + 8], al
push cs
jbe 0x4015ec
xor ecx, ecx
cmp dword [eax + 0x4000e8], edx
setne cl
lea ecx, [ebp - 0x1c]
jecxz 0x4015ef
mov dword [esp + 0x33], esi
fild dword [ebx + 0x53]
xor ebx, ebx
inc ebx
push ebx
call fcn.00402adc
pop ecx
test ecx, eax
jne 0x401605
push 0x1c
call fcn.0040155c
pop ecx
call fcn.00402917
test eax, eax
jne 0x401616
push 0x10
call 0xf840155c
pop ecx
call fcn.004025b3
mov dword [ebp - 4], ebx
call fcn.004022df
test eax, eax
jge 0x40162f
push 0x1b
call int.00401992
pop ecx
call sub.KERNEL32.dll_GetCommandLineW
jecxz 0x40162e
rol byte [eax], 0xec
invalid
call fcn.00402cbc
jmp 0x401585

Function at 0x4024ff
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
div dword [ecx + 0x40b11c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x402538
mov eax, dword [0x40a118]
cmp dword [edi + edi*8 - 0x2fe88c], 0x35
sbb al, 0xa1
inc eax
add bh, bh

Function at 0x403b90
Capabilities:
Allocate thread local storage

Disassembly:
inc eax
add byte [ebp + 0x3e886], cl
add byte [ebx], bh
add eax, 0x40be7c
Function at 0x40de90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x4425ce]
movsx ecx, ax
mov eax, dword [0x43b2b4]
not ecx
not eax
imul eax, ecx
mov ecx, dword [0x43f20c]
mov edx, dword [0x43c158]
xor ecx, eax
imul edx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [0x43c158], edx
call fcn.0041e360
mov ecx, edi
mov esi, eax
call fcn.00427c60
cmp esi, eax
je 0x40df2b
jmp 0x40dee0
mov eax, dword [0x43e4e4]
movzx ecx, word [0x442b9e]
sar eax, 3
xor eax, 0x80210831
and ecx, eax
mov word [0x442b9e], cx
mov byte [esi], 0
mov dx, word [0x4424d0]
mov ecx, dword [0x43b5fc]
movsx eax, dx
or ecx, eax
or ecx, 0xfdfff55f
mov word [0x4424d0], cx
mov ecx, edi
inc esi
call fcn.00427c60
cmp esi, eax
jne 0x40dee0
mov dx, word [0x440cf2]
movsx eax, dx
not eax
or eax, 0xb63a4f4d
cmp eax, 0x73151682
pop edi
pop esi
jl 0x40df51
or dword [0x43dac0], 0x7db35bc2
pop ebp
ret
dec dword [0x43d39c]
mov eax, dword [0x43d39c]
xor eax, 0xe797ebed
or eax, 0xc185aac5
sub dword [0x438de8], eax
pop ebp
ret
Function at 0x41f3f0
Capabilities:
Hash data with md5

Disassembly:
movzx eax, word [0x443e74]
sub eax, 0x7ffac19e
mov word [0x443e74], ax
mov dword [ecx], 0
mov edx, dword [0x43799c]
add edx, 0x9b6caf5
and edx, 0x21ceecaa
mov word [0x44224c], dx
mov dword [ecx + 4], 0
xor dword [0x43b178], 0x7cc12e2f
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x43a9a8]
mov edx, dword [0x43b098]
sar eax, 5
sar edx, 9
lea eax, [edx + eax + 0x5d5b81ee]
cmp eax, 0xdb7e85fc
jl 0x41f474
mov eax, dword [0x438f08]
movzx edx, word [0x4429f8]
and eax, 0x21a8e3c3
add eax, eax
add edx, eax
mov word [0x4429f8], dx
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x43b750]
or edx, 0xffffffff
add dword [0x43b750], edx
cmp eax, 0x935bc61
jle 0x41f49c
or dword [0x4382a0], 0x618cc342
jmp 0x41f4a6
add dword [0x43f7d4], 0x62060802
mov dword [ecx + 0x10], 0x98badcfe
mov ax, word [0x440588]
cwde
add eax, 0x130cc79
or dword [0x43e640], eax
add word [0x440588], dx
mov dword [ecx + 0x14], 0x10325476
and dword [0x43cf8c], 0xdf1a0c01
ret

Function at 0x423560
Capabilities:
Encode data using xor

Disassembly:
or dword [0x436f20], 0x3a91b530
xor dword [0x43fb24], 0x14814
push esi
push edi
mov edi, ecx
call fcn.0041e360
mov esi, eax
mov ax, word [0x4411ee]
movsx ecx, ax
mov eax, dword [0x43d734]
imul eax, ecx
or dword [0x43e548], eax
mov ecx, edi
call fcn.00427c60
cmp esi, eax
je 0x4235e6
movzx ecx, word [0x4417ea]
xor ecx, 0x5699046
mov word [0x4417ea], cx
mov byte [esi], 0
mov eax, dword [0x43dc7c]
xor eax, 0x2a155c2f
sub dword [0x43ba2c], eax
mov edx, dword [0x43d808]
imul edx, edx, 0x1690e970
mov ecx, edi
inc esi
mov dword [0x43d808], edx
call fcn.00427c60
cmp esi, eax
jne 0x4235a1
add dword [0x438450], 0x7e71d822
pop edi
pop esi
ret
Function at 0x4084e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4276d4], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408525
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408502
mov dword [edx*4 + 0x4276d0], eax
inc edx
cmp edx, 0x100
jne 0x4084fb
mov eax, dword [ebp + 8]
not eax
jmp 0x40853f
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4276d0]
test ebx, ebx
jne 0x40852c
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call fcn.1000106f
Function at 0x1005d425
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1005d434
pop dword [ebp - 0x4c]
mov eax, 0x1005d434
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x2087fde7
sub dword [ebp - 0x5c], 0xd235b89c
mov dword [ebp - 0x58], 0xe4e08f05
add dword [ebp - 0x58], 0x4d52bd40
mov dword [ebp - 0x54], 0xa2006ba9
sub dword [ebp - 0x54], 0x55b4277b
mov dword [ebp - 0x50], 0xd54da491
sub dword [ebp - 0x50], 0xd54da491
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xa2ef8ed
add eax, 0x5d97747
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe3d5d350
add dword [ebp - 0x5c], 0x909c9606
mov dword [ebp - 0x58], 0xb04d8ddc
sub dword [ebp - 0x58], 0x6ee12c67
mov dword [ebp - 0x54], 0x1be33dd7
sub dword [ebp - 0x54], 0xb873d16b
mov dword [ebp - 0x50], 0xc96cfc5d
sub dword [ebp - 0x50], 0xc96cfc5d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x2032f9d0
sub eax, 0x102a89ac
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a188
push 0
call eax
mov ecx, 0x6592c37b
add ecx, 0x9a6d7749
mov edi, eax
mov esi, 0x47523e5d
add esi, 0xc8b951a3
add esi, dword [ebp - 0x4c]
mov ebx, 0xbbd88cee
sub dword [ebp - 0x20], 0x77906211
mov edx, dword [esi]
sub dword [ebp - 8], ebx
xor edx, ebx
add dword [ebp - 0x1c], edi
mov dword [edi], edx
add dword [ebp - 0x48], 0x21cfbb5e
add edi, 0x57620ca3
sub edi, 0x57620c9f
add esi, 0xce73994d
sub esi, 0xce739949
loop 0x1005d54b
add eax, 0x301e9c32
sub eax, 0x301dbe4f
xor ebx, ebx
add ebx, eax
add eax, 0x74a48ed4
add eax, 0x8b5b7131
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x6d44d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
add edi, eax
pushfd
mov byte [esp], 3
clc
mov edi, dword [edi + ecx*4]
cmp cx, bx
clc
test edi, edi
call fcn.006c7ca8
lea esp, [esi - 0x25]
test byte [eax + 0x53], bh
lodsb al, byte [esi]
jp 0x6d453f
or cl, dl
jg 0x6d4554
cmp ebp, dword [0x6485c8d6]
inc ebp
aaa
invalid
mov ch, 0x8d
enter 0x4d1e, 0x72
cli
invalid
sub eax, 0x9c3ed849
imul eax, dword [ebp - 0x46ec08da], 0x73e9d86
add byte [esi - 0x6e], dl
fdiv dword [edx + 0x3910e2be]
add edi, dword [esi + edi*4 - 0x6d]
loop 0x6d4566
cmp dword [ebx], eax
jl 0x6d4518
xchg ebx, eax
adc byte [ebp + 0x42], 0x17
mov cl, 0x84
inc ebp
cmpsd dword [esi], dword es:[edi]
fadd qword [ecx + 0x3d7dc0a6]
push cs
sar byte [ebp + 0x3d], 0xe
out 0xbb, al
xor al, 0x24
and al, 0xff
and ecx, 0xffffffa1
jb 0x6d45c9
adc al, 0xd1
ret
movsd dword es:[edi], dword [esi]
xchg edi, eax
dec esp
sub esi, eax
loop 0x6d455b
push 0xf
add edx, eax
mov eax, dword [0x609bf252]
sbb dword [edx - 0x53802e7c], edx
ljmp 0xf4d7
Function at 0x407a9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x407aab
pop dword [ebp - 0x44]
mov eax, 0x9a6a05d6
sub eax, 0x9a298b2b
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x8d3fa899
sub dword [ebp - 0x54], 0x3eed634e
mov dword [ebp - 0x50], 0xfd5256fc
sub dword [ebp - 0x50], 0xcb1f0ab7
mov dword [ebp - 0x4c], 0x74497919
sub dword [ebp - 0x4c], 0x27fd34eb
mov dword [ebp - 0x48], 0x2dcc53c6
add dword [ebp - 0x48], 0xd233ac3a
lea eax, [ebp - 0x54]
push eax
mov eax, 0x48000a9f
sub eax, 0x47bf6a93
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xab875cde
sub dword [ebp - 0x54], 0x3714f388
mov dword [ebp - 0x50], 0x731f0cb2
add dword [ebp - 0x50], 0xce4d54c3
mov dword [ebp - 0x4c], 0xacbbcf58
sub dword [ebp - 0x4c], 0x494c62ec
mov dword [ebp - 0x48], 0x766a2ac6
add dword [ebp - 0x48], 0x8995d53a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf8340ce3
sub eax, 0xf7f36ccf
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38257
push 0
call eax
mov ecx, 0x4545
xor esi, esi
add esi, eax
mov edx, 0x43be00
add edx, dword [ebp - 0x44]
mov ebx, 0xb40a5b83
sub dword [ebp - 4], 0x26be1ec8
mov edi, dword [edx]
sub dword [ebp - 0xc], eax
xor edi, ebx
sub dword [ebp - 0x30], edi
mov dword [esi], edi
mov dword [ebp - 0x18], 0x2d20898e
add esi, 4
add edx, 4
loop 0x407bbd
add eax, 0xcce01cdb
sub eax, 0xccdf14f4
xor ebx, ebx
add ebx, eax
add eax, 0x78a2b95f
add eax, 0x875d46a6
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret