joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f68c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.0042f2e4
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x39f7cb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x42f73a
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x42f6e7
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x42f788
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.00402910
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.0042ed64
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.00402910
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x42f7b2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x42f7b2
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x42f7a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x39f7d2
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042f480
ret

Function at 0x43df94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jl 0x43dfe8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x483814]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x483c14]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + fcn.00484014]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x484414]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x43dfa3
pop edi
pop esi
pop ebx
ret
Function at 0x49efd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4a4c70]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x40f1a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004971a0
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004983c8
mov eax, dword [esi]
call fcn.00485ca0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x49f042
mov eax, dword [esi]
call fcn.00485ca0
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.00485cac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x49f066
mov eax, dword [esi]
call fcn.00485cac
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485c94
cmp eax, dword [ebp - 0x18]
jle 0x49f07c
mov eax, dword [esi]
call fcn.00485c94
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00485c88
cmp eax, dword [ebp - 0xc]
jle 0x49f092
mov eax, dword [esi]
call fcn.00485c88
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call fcn.004078d4
call fcn.00406e14
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x49f159
mov eax, ebx
call fcn.00404534
cmp eax, 0x64
jge 0x49f159
cmp dword [0x49226c], 0
je 0x49f159
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f159
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.00407924
cmp dword [ebp - 8], 0
je 0x49f11c
mov bl, 2
jmp 0x49f137
lea edx, [ebp - 0x20]
mov eax, dword [0x4ac830]
call fcn.004a2268
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x49f135
xor ebx, ebx
jmp 0x49f137
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x492374]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call dword [0x49226c]
mov eax, dword [0x4a4a7c]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.0049b08c
push 4
mov eax, dword [ebp - 4]
call fcn.0049d958
push eax
call fcn.0040791c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f1b0
call fcn.00406e14
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x4d31c4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x4d31d7
add esp, 0xfffffff0
call fcn.004036f0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0040335c
mov byte [ebx + 4], 0
cmp dword [esi + 0x5c], 0
jne 0x4d31fd
cmp dword [esi + 0x58], 0x40
jb 0x4d33e3
jmp 0x4d3203
jl 0x4d33e3
lea eax, [ebx + 0xc]
mov edx, 0x40
call fcn.004079c8
push 0
push 0
push 0
push 0x40
lea edx, [ebx + 0xc]
mov eax, esi
call fcn.004d2ac8
cmp word [ebx + 0xc], 0x5a4d
jne 0x4d33e3
mov ecx, dword [ebx + 0x48]
test ecx, ecx
jle 0x4d33e3
cmp ecx, 0x10000
jge 0x4d33e3
mov eax, ecx
add eax, 4
add eax, 0x14
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d325e
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d3264
jg 0x4d33e3
lea eax, [ebx + 0x4c]
mov edx, 4
call fcn.004079c8
mov eax, dword [ebx + 0x48]
cdq
push edx
push eax
push 0
push 4
lea edx, [ebx + 0x4c]
mov eax, esi
call fcn.004d2ac8
cmp dword [ebx + 0x4c], 0x4550
jne 0x4d33e3
lea eax, [ebx + 0x50]
mov edx, 0x14
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
cdq
push edx
push eax
push 0
push 0x14
lea edx, [ebx + 0x50]
mov eax, esi
call fcn.004d2ac8
mov ax, word [ebx + 0x50]
cmp ax, 0x8664
jne 0x4d331b
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xf0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d32df
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d32e5
jg 0x4d336c
lea eax, [ebx + 0x144]
mov edx, 0xf0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xf0
lea edx, [ebx + 0x144]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
jmp 0x4d336c
cmp ax, 0x14c
jne 0x4d336c
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
add eax, 0xe0
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d333c
cmp eax, dword [esi + 0x58]
ja 0x4d336c
jmp 0x4d333e
jg 0x4d336c
lea eax, [ebx + 0x64]
mov edx, 0xe0
call fcn.004079c8
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
cdq
push edx
push eax
push 0
push 0xe0
lea edx, [ebx + 0x64]
mov eax, esi
call fcn.004d2ac8
mov byte [ebx + 4], 1
cmp byte [ebx + 4], 0
je 0x4d33e3
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
mov di, word [ebx + 0x52]
movzx edx, di
shl edx, 3
lea edx, [edx + edx*4]
add eax, edx
cdq
cmp edx, dword [esi + 0x5c]
jne 0x4d339d
cmp eax, dword [esi + 0x58]
ja 0x4d33e3
jmp 0x4d339f
jg 0x4d33e3
movzx eax, di
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x442550]
call fcn.0040599c
add esp, 4
mov eax, dword [ebx + 0x48]
add eax, 4
add eax, 0x14
movzx edx, word [ebx + 0x60]
add eax, edx
cdq
push edx
push eax
movzx eax, word [ebx + 0x52]
shl eax, 3
lea eax, [eax + eax*4]
xor edx, edx
push edx
push eax
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004d2ac8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d33fa
call fcn.00403748
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4d40e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44419f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x4d4191
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x4d417a
test esi, esi
jbe 0x4d4191
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a644
test eax, eax
jne 0x4d416c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x4d4191
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x4d4149
jmp 0x4d4191
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x4d4191
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4441a6
ret
Function at 0x4d4bc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x444d6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404980
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4d4bfb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4d4c14
lea eax, [ebp - 0x10]
mov edx, dword [0x4a4c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.004049e0
jmp 0x4d4c27
lea eax, [ebp - 0x10]
mov edx, dword [0x4a4c48]
mov edx, dword [edx]
mov edx, dword [edx + 0x14]
call fcn.004049e0
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4d4c33
adc edx, 0
mov edx, dword [edx*4 + 0x4928ac]
call fcn.00404bec
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404bd0
push eax
call fcn.00406b4c
mov esi, eax
cmp esi, 0xffffffff
je 0x4d4d41
mov eax, 0x40
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4d4d34
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406fcc
mov eax, edi
call fcn.00402734
mov eax, 0x18
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4d4d34
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x4d4d34
cmp dx, 0x150
ja 0x4d4d34
mov eax, edi
call fcn.00402734
mov eax, 0xe0
call fcn.00402714
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406f5c
test eax, eax
je 0x4d4d34
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x4d4d34
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.004049bc
mov eax, edi
call fcn.00402734
push esi
call fcn.00406b04
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.00404cf8
jne 0x4d4d59
inc ebx
cmp ebx, 0x19
jne 0x4d4bed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444d76
lea eax, [ebp - 0x10]
call fcn.00404980
ret
Function at 0x509568
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4b1594
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x50958a
shr eax, 1
xor eax, 0xedb88320
jmp 0x50958c
shr eax, 1
dec edx
jne 0x509578
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x509571
mov byte [0x4b1994], 1
pop esi
pop ebx
ret

Function at 0x5095a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4b1994], 0
jne 0x5095bf
call fcn.00509568
mov eax, edi
dec eax
test eax, eax
jl 0x5095e8
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b1594]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5095c9
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xe31058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00e311a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe3107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe3106a
add dl, dl
jne 0xe31089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe310dc
xor eax, eax
add dl, dl
jne 0xe31096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe3117d
add dl, dl
jne 0xe310a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe310b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe310bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe310c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe310d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe31075
mov eax, 1
add dl, dl
jne 0xe310ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe310f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe310e1
sub eax, ebx
mov ebx, 1
jne 0xe31128
mov ecx, 1
add dl, dl
jne 0xe3110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe31119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe31105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe31075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe3113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe3114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe31136
cmp eax, 0x7d00
jae 0xe3116d
cmp eax, 0x500
jb 0xe31168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe31075
cmp eax, 0x7f
ja 0xe31170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe31075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe3119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe31075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [0x468800]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov esi, ebx
mov ebx, esi
xor eax, esi
xor esi, esi
mov ebx, eax
xor ebx, ebx
mov ebx, eax
xor ebx, eax
and edx, 0x96
sub eax, 0xe4
inc edi
inc eax
inc ebx
and edx, 0x98
or edi, 0xf7
neg edx
neg edx
neg ebx
dec esi
add edx, 0x91
dec esi
inc edx
bswap edi
or eax, 6
and ebx, 0xca
and esi, 0xcf
dec edx
ror esi, 0xff
sbb esi, 0xe2
ror edx, 0x70
not edi
imul ebx
rcl eax, 0x6d
mov ebx, 0x7a
dec edi
and edi, 0xe6
dec esi
neg esi
inc ebx
neg edx
rol esi, 0xc8
mov esi, 0x44
imul eax
and edi, 0x74
and edx, 0xb4
not ebx
dec ebx
and edi, 0xdc
rol edx, 0x9d
mov ebx, 0x84
ror edi, 0xca
sub esi, 0x9c
add edi, 0x56
ror edi, 0xb0
bswap edx
imul ebx
imul eax
inc ebx
xor ecx, ecx
xor edi, edi
mov eax, eax
xor eax, ebx
mov esi, eax
mov esi, esi
xor eax, esi
xor ebx, ebx
dec esi
dec ebx
and edx, 0x87
not edi
inc edx
bswap esi
sub eax, 0xd0
imul esi
sub ebx, 0x7e
or ebx, 0xea
dec esi
mov edi, 0xd0
or esi, 0x8e
inc edi
rol esi, 2
neg eax
and ebx, 0xb6
or esi, 0xc4
rol ebx, 0x22
rcr ebx, 0xb9
dec esi
ror esi, 0x14
bswap esi
inc ebx
mov esi, 0x73
bswap esi
sbb edi, 0xeb
inc edx
inc edi
not edx
dec eax
inc edi
neg esi
neg esi
not ebx
dec edi
neg edi
sub eax, 0xe3
add eax, 0x91
add esi, 0xed
inc esi
mov edi, 0x47
dec eax
imul eax
add eax, 0x36
inc esi
bswap ebx
inc edi
sub edi, 0x52
and edi, 0xd5
mov esi, eax
xor ebx, esi
xor ebx, esi
xor esi, esi
mov eax, ebx
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov ebx, esi
mov ecx, dword [ebp + 0xc]
neg edx
and esi, 0x3e
rcr edi, 0xac
mov edi, 0x8e
sub edi, 0xb0
rol esi, 0x1f
imul eax
sbb ebx, 0xb7
imul ebx
and edx, 0x5c
neg edx
bswap edi
add ebx, 0x51
rol ebx, 0xe1
and esi, 0x34
imul edi
bswap edi
bswap eax
rcr edx, 0xa6
inc eax
rcl esi, 0xb7
mov eax, 0x5d
inc esi
rol eax, 0x37
neg ebx
sbb ebx, 0xc0
rcl esi, 0xc8
dec esi
not esi
neg ebx
rcl edi, 0x12
and edi, 0x75
ror eax, 0x10
imul eax
dec edx
sbb esi, 0x3c
not edi
add eax, 0xcb
not eax
inc esi
imul esi
sub eax, 0xd0
rcr edi, 0x20
rcl eax, 0xd3
not edx
or ebx, 0x94
bswap eax
imul ebx
neg esi
not edx
mov edi, dword [ebp + 8]
xor esi, eax
xor esi, eax
mov ebx, eax
xor eax, ebx
xor ebx, ebx
xor eax, ebx
xor ebx, ebx
xor esi, eax
mov ebx, esi
not byte [edi]
mov eax, eax
mov ebx, esi
mov ebx, ebx
mov eax, eax
xor ebx, esi
xor eax, ebx
mov eax, ebx
mov eax, eax
xor ebx, esi
xor esi, eax
mov esi, esi
xor eax, eax
sub byte [edi], 0x39
mov eax, ebx
xor esi, eax
mov ebx, eax
xor esi, ebx
xor esi, eax
mov esi, eax
add byte [edi], 0x68
xor eax, eax
mov ebx, eax
mov ebx, ebx
mov eax, ebx
xor ebx, eax
mov eax, esi
xor esi, eax
mov ebx, ebx
xor eax, eax
imul byte [edi]
inc edi
loop 0x40120a
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004013b0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x408ea7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x408eb6
pop dword [ebp - 0x44]
mov eax, 0x8aaea782
add eax, 0x7591e734
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ca37
push 0
mov eax, 0xcfb99135
sub eax, 0xcf779f25
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x1208ae06
sub ecx, 0x12086ce9
xor edx, edx
add edx, eax
mov esi, 0x438200
add esi, dword [ebp - 0x44]
mov ebx, 0xf8c09895
add ebx, 0x220bf7a
xor dword [ebp - 8], 0xc731dd2a
mov edi, dword [esi]
add dword [ebp - 4], ecx
xor edi, ebx
add dword [ebp - 0x28], edi
mov dword [edx], edi
mov dword [ebp - 0x30], 0xcc5b10e9
add edx, 0xd2a8b6d1
add edx, 0x2d574933
add esi, 0xfadb0daf
add esi, 0x524f255
loop 0x408f11
add eax, 0xf747
xor ebx, ebx
add ebx, eax
add eax, 0xf4bc24b
sub eax, 0xf4bc246
mov ecx, 0xe8710b96
sub ecx, 0xe8310b96
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1000dcdd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000dcec
pop dword [ebp - 0x10]
mov eax, 0x77f64b2e
sub eax, 0x67f56e42
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x608899fd
add dword [ebp - 0x20], 0xedc9ab4e
mov dword [ebp - 0x1c], 0x80d07773
add dword [ebp - 0x1c], 0xb162d4d2
mov dword [ebp - 0x18], 0xbfad9e4a
add dword [ebp - 0x18], 0x8c9ea5e4
mov dword [ebp - 0x14], 0x2a1e512d
add dword [ebp - 0x14], 0xd5e1aed3
lea eax, [ebp - 0x20]
push eax
mov eax, 0xbfc90f11
add eax, 0x5041e147
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xdf3f9769
sub dword [ebp - 0x20], 0x6acd2e13
mov dword [ebp - 0x1c], 0xaa2f7f02
add dword [ebp - 0x1c], 0x973ce273
mov dword [ebp - 0x18], 0x1fec8e5b
add dword [ebp - 0x18], 0x4382de11
mov dword [ebp - 0x14], 0x8933bcbd
add dword [ebp - 0x14], 0x76cc4343
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xc8856c45
add eax, 0x47858453
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x472d7
push 0
call eax
mov ecx, 0x3d84
mov edx, eax
mov ebx, 0x14f36662
add ebx, 0xfb1f179e
add ebx, dword [ebp - 0x10]
mov esi, 0x5082de7d
xor dword [ebp - 0xc], eax
mov edi, dword [ebx]
xor dword [ebp - 4], ebx
sub edi, esi
mov dword [edx], edi
xor dword [ebp - 8], 0x59b7ae16
add edx, 4
add ebx, 4
loop 0x1000de02
add eax, 0xe8e3
mov ebx, eax
add eax, 5
mov ecx, 0xe9eb1c0f
add ecx, 0x2614e3f1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1002deab
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e9af
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x100eed78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
and dword [ebp - 4], 0
push 0
mov dword [esi], vtable.FtpSession.0
call fcn.1000dcdd
lea ecx, [esi + 0x64]
call fcn.1000dcdd
lea ecx, [esi + 0x30]
call fcn.10002a67
mov ecx, esi
mov dword [esi], vtable.InetFtpAsyncObj.0
call fcn.1000dcdd
test byte [ebp + 8], 1
je 0x1002df0b
push esi
call fcn.1000dcdd
pop ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret 4
Function at 0x100303c8
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xor edx, edx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebx], edx
test ecx, ecx
je 0x10030405
mov eax, dword [esi + 4]
cmp eax, 4
je 0x100303eb
cmp eax, 5
jne 0x10030405
cmp dword [esi + 0x98], edx
jne 0x10030419
sub eax, 4
je 0x1003040e
sub eax, 1
jne 0x10030405
mov eax, dword [esi + 0x78]
mov dword [ebx], eax
mov dword [esi + 0x78], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov dword [esi + 0x9c], eax
jmp 0x10030405
mov cl, byte [esi + 0x7c]
test cl, cl
je 0x10030405
cmp eax, 5
jne 0x10030405
lea edi, [esi + 0xa0]
cmp dword [edi], edx
jne 0x1003048d
push dword [esi + 0x64]
push str.call_InternetWriteFile_0x_08x__n
push 7
push 0xc
call fcn.1001ef2c
add esp, 0x10
lea ecx, [esi + 0x34]
mov eax, dword [ecx]
push edx
call dword [eax + 0x24]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x64]
call dword [sym.imp.WININET.dll_InternetWriteFile]
mov byte [esi + 0x7c], al
test al, al
je 0x1003047a
push dword [esi + 0x64]
push str.InternetWriteFile_0x_08x__completed_synchronously_n
push 7
push 0xc
call fcn.1001ef2c
mov al, byte [esi + 0x7c]
add esp, 0x10
xor edx, edx
mov cl, al
test al, al
je 0x1003048d
cmp dword [edi], edx
jne 0x1003048d
mov ecx, dword [ebp + 0xc]
mov dword [edi], ecx
mov cl, al
test cl, cl
je 0x100304ac
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi]
sub dword [esi + 0x78], eax
mov dword [edi], edx
je 0x100304ac
mov ecx, dword [esi + 0x48]
push edx
mov eax, dword [ecx]
call dword [eax + 0x34]
jmp 0x10030405
movsx eax, byte [esi + 0x7c]
push ecx
push edx
push eax
lea ecx, [esi + 0x34]
call fcn.1000dcdd
jmp 0x10030407