joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408090
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
mov dword [esp + 8], 0x80000
test eax, eax
je 0x40829e
push edi
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
je 0x40829d
mov eax, dword [0x40d330]
push ebp
push 0x80000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x408295
cmp dword [esp + 0x30], ebx
jl 0x408111
mov eax, dword [esp + 0x2c]
jg 0x408102
test eax, eax
je 0x408111
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x34]
add edx, 0x80000
mov dword [esp + 0x28], edx
jmp 0x408125
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub dword [esp + 0x28], 0x80000
add ebx, 0x80000
and eax, ecx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x40815d
mov eax, ebx
cdq
cmp edx, ecx
jl 0x40815d
jg 0x408155
cmp eax, dword [esp + 0x34]
jbe 0x40815d
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x18]
mov eax, ebp
mov edx, ebx
cmp ebx, 8
jb 0x40825c
mov edi, ebx
shr edi, 3
jmp 0x408190
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov esi, dword [esp + 0x1c]
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 1]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 2]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 3]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 4]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 5]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 6]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
movzx esi, byte [eax + 7]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x40b228]
add eax, 8
sub edx, 8
dec edi
mov esi, ecx
jne 0x408190
mov edi, dword [esp + 0x20]
test edx, edx
je 0x408279
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x40b228]
inc eax
dec edx
jne 0x408260
cmp ebx, 0x80000
je 0x408121
mov edx, dword [0x40d330]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x14
ret 0x14

Function at 0x4082d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40280f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
push 0
call dword [0x408010]
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
and dword [ebp - 0x14], 0
jmp 0x40285e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x4029e7
push 0x410770
call dword [0x40800c]
mov eax, dword [0x409040]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x409040], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x402965
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
cmp dword [ebp - 4], 0
jle 0x402953
mov eax, dword [0x40903c]
imul eax, dword [0x409040]
mov ecx, dword [0x409040]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x40903c], eax
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [0x408034]
mov dword [ebp - 0xc], eax
mov eax, dword [0x409040]
shl eax, 1
mov dword [0x40903c], eax
push 0
push 0
push 0
call fcn.004035ec
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
mov eax, dword [0x40903c]
imul eax, eax, 0x63
mov dword [0x40903c], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.0040362a
add esp, 0xc
mov eax, dword [0x409040]
add eax, 7
mov dword [0x40903c], eax
jmp 0x40284e
mov eax, dword [0x409040]
imul eax, dword [0x409040]
sub eax, 3
mov dword [0x40903c], eax
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [0x408034]
mov dword [ebp - 0xc], eax
mov eax, dword [0x40903c]
sub eax, 4
mov dword [0x409040], eax
mov eax, dword [0x409040]
shl eax, 3
mov dword [0x409040], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call fcn.004035ec
add esp, 0xc
push 0x410770
call dword [0x40800c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
jmp 0x40284e
push 0
push 0
push 0
call fcn.0040362a
add esp, 0xc
leave
ret
Function at 0x4517c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x4517f1
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0x4517e2
and ecx, 3
je 0x451809
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0x4517f6
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x451814
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0x45184d
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0x451835
pop esi
and esi, 3
je 0x451872
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0x451853
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x45187c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0x4518a8
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0x451899
and ecx, 3
je 0x4518c0
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0x4518ad
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x4518c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0x4518d4
pop edi
pop ebx
ret
Function at 0x4521f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call dword [eax + 0x20]
mov esi, eax
mov eax, esi
shr eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
call fcn.00451e48
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45232f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
dec edi
test edi, edi
jl 0x45229e
inc edi
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0042493c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004518c8
lea eax, [ebx + esi]
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
call fcn.0042493c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004518c8
lea eax, [ebx + esi]
mov ebx, eax
dec edi
jne 0x45224b
mov eax, esi
add eax, eax
push eax
mov eax, dword [ebp - 8]
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
cmp esi, edi
jg 0x4522ec
mov edx, dword [ebp - 0x10]
mov eax, ebx
mov ecx, esi
call fcn.0042493c
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
call fcn.004518c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov ecx, esi
call fcn.0042493c
lea eax, [ebx + esi]
mov ebx, eax
sub edi, esi
test edi, edi
jle 0x452316
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
dec edi
test edi, edi
jl 0x452316
inc edi
xor eax, eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 8]
mov dl, byte [edx + eax]
xor byte [ebx + eax], dl
inc eax
dec edi
jne 0x452306
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452336
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00451fe4
ret
Function at 0xdd0dec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdd0df6
pushal
call 0xdd0dfc
pop ebp
sub ebp, 0x10
sub ebp, 0x9d0dec
jmp 0xdd0e12
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x119a0b9e
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd0e29
jmp 0xdd0e3c
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 4
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
lea esp, [esp - 4]
mov dword [esp], eax
lea esp, [esp - 4]
mov dword [esp], eax
push 0x219af8
push 0x7b72f4
add dword [esp], ebp
push 0xa473170e
call fcn.00dd0e8c
jmp 0xdd0eb4
mov ecx, dword [esp + 4]
push 0x219af8
push 0x7b72f4
add dword [esp], ebp
lea esp, [esp - 4]
mov dword [esp], ecx
call fcn.00dd0ed9
jmp 0xdd1126
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xdd1137
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x371
mov ecx, 0x2a8
mov edx, 0x9d5757f
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd114e
jmp 0xdd1161
xchg esi, edi
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0xa0]
add edi, esi
push esi
pop ebx
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x34]
sub ebx, eax
xchg edx, edi
mov edi, dword [edx]
xchg edx, edi
xchg ecx, edi
mov edi, dword [ecx + 4]
xchg ecx, edi
cmp edx, 0
je 0xdd11df
add edx, esi
add edi, 8
sub ecx, 8
cmp ecx, 0
je 0xdd117f
mov ax, word [edi]
shr eax, 0xc
and eax, 0xf
cmp eax, 3
jne 0xdd11d5
mov ax, word [edi]
and eax, 0xfff
add eax, edx
add dword [eax], ebx
dec ecx
dec ecx
add edi, 2
jmp 0xdd11a7
jmp 0xdd11e8
mov eax, 0x9d0dec
add eax, ebp
add eax, 0x422
mov ecx, 0x1f7
mov edx, 0xe2c039b4
xor byte [eax], dl
inc eax
dec ecx
jne 0xdd11ff
jmp 0xdd1212
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0x80]
add edi, esi
cmp dword [edi + 0xc], 0
je 0xdd12e3
mov eax, dword [edi + 0xc]
add eax, esi
push eax
call dword [ebp + 0x7b6ec4]
cmp eax, 0
jne 0xdd1254
xchg edi, eax
mov edi, dword [eax + 0xc]
xchg edi, eax
add eax, esi
lea esp, [esp - 4]
mov dword [esp], eax
call dword [ebp + 0x7b6ed0]
cmp dword [edi + 0xc], 0
je 0xdd12e3
cmp dword [edi], 0
jne 0xdd1272
cmp dword [edi + 0x10], 0
je 0xdd12d7
lea esp, [esp - 4]
mov dword [esp], ebp
push ebp
pop edx
xchg ebp, edi
mov edi, dword [ebp + 0x10]
xchg ebp, edi
add ebp, esi
cmp dword [ebp], 0
je 0xdd12d7
xchg ecx, ebp
mov ebp, dword [ecx]
xchg ecx, ebp
push eax
lea esp, [esp - 4]
mov dword [esp], edx
or ecx, ecx
jns 0xdd12ab
push ecx
jmp 0xdd12b4
add ecx, esi
add ecx, 2
push ecx
lea esp, [esp - 4]
mov dword [esp], eax
call dword [edx + 0x7b6ec8]
pop edx
mov dword [ebp], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add ebp, 4
jmp 0xdd1284
pop ebp
add edi, 0x14
jmp 0xdd121e
push esp
push dword fs:[0]
push 0x9d1406
push ebp
lea esp, [esp - 4]
mov dword [esp], esi
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x28]
add eax, esi
jmp eax

Function at 0xdd0e8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0xdd0ea4
pop ebp
ret 0xc
Function at 0xdd0f67
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xdd0f98
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd0f76
add dl, dl
jne 0xdd0fab
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd101b
xor eax, eax
add dl, dl
jne 0xdd0fc0
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdd10f0
add dl, dl
jne 0xdd0fd3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd0fe2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd0ff1
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd1000
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdd100e
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdd0f8b
mov eax, 1
add dl, dl
jne 0xdd102d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdd103c
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd1020
sub eax, ebx
mov ebx, 1
jne 0xdd1083
mov ecx, 1
add dl, dl
jne 0xdd1061
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd1070
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd1054
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd0f8b
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdd109e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdd10ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdd1091
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdd0f8b
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdd1118
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdd0f8b
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x407073
Capabilities:
Resolve dns

Disassembly:
mov dword [esi + 4], eax
mov esp, dword [esi]
or byte [ecx - 0x1ce14cf], cl
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
jb 0x4070cd
or al, 0x75
test dword [ebx + 0x40c1d835], ecx
add bh, bh
salc
test dword [esp + esi*2 + 0x2f], ecx
call esi
pop edi
pop esi
fadd dword [edx]
fst st(5)
std
pop ebx
jmp ebp
pop ebp
ret
Function at 0x1001d320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e437
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x40c
call fcn.1008caf8
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x10098660
mov eax, dword [esi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
call fcn.10017860
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e493
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100c96d8]
mov ecx, dword [ebp + 8]
add eax, ecx
je 0x1001e097
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov eax, dword [0x100c96e4]
mov dword [eax + ecx], 0
mov eax, dword [0x100c96e8]
mov dword [eax + ecx], 0xff7fffff
mov eax, dword [0x100ce850]
test al, 1
jne 0x1001e115
or eax, 1
mov dword [0x100ce850], eax
mov dword [ebp - 4], 0
mov eax, dword [0x100c9554]
mov ebx, dword [eax + 0x30]
jmp 0x1001e0fc
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x1001e0d0
xor edx, edx
test ecx, ecx
je 0x1001e0f9
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1001e0e0
cmp esi, 0x731ec79a
je 0x1001e100
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1001e0c0
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x34]
call eax
mov dword [0x100ce84c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100c9554]
mov ebx, dword [eax + 0x30]
jmp 0x1001e15c
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x1001e130
xor edx, edx
test ecx, ecx
je 0x1001e159
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1001e140
cmp esi, 0x731ec79a
je 0x1001e160
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1001e120
mov eax, dword [ebx]
mov ecx, ebx
push 0
mov eax, dword [eax + 0x40]
call eax
mov ecx, dword [0x100c975c]
mov ebx, dword [ebp + 8]
add ecx, 0xffffffd0
xor ecx, 0x46b12fb2
mov esi, dword [ecx + ebx]
mov eax, esi
or eax, 8
mov dword [ecx + ebx], eax
lea ecx, [ebx + 4]
mov eax, dword [ebp + 0x14]
mov byte [0x100b55f0], 1
push ecx
movss xmm0, dword [eax + 0x14]
mov eax, dword [ecx]
movss dword [esp], xmm0
push 0x7ff00
push 0x80
push dword [ebp + 0x10]
mov eax, dword [eax + 0x34]
call eax
mov ecx, dword [0x100c975c]
add ecx, 0xffffffd0
mov byte [0x100b55f0], 0
xor ecx, 0x46b12fb2
mov byte [ebp + 0xb], al
mov dword [ecx + ebx], esi
mov ecx, dword [0x100c9554]
mov ebx, dword [ecx + 0x30]
jmp 0x1001e21c
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x1001e1f0
xor edx, edx
test ecx, ecx
je 0x1001e219
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x1001e200
cmp esi, 0x731ec79a
je 0x1001e220
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1001e1e0
mov eax, dword [ebx]
mov ecx, ebx
push dword [0x100ce84c]
mov eax, dword [eax + 0x40]
call eax
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10