joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a8760be
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a985659
call fcn.2a84a73f
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a8760e0
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a863507
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a876122
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a8761d3
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + 0x2a98cc18]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a876155
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + 0x2a98cc18]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a876196
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a876172
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a876188
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + 0x2a98cc18]
mov eax, dword [ebp - 0x10]
jmp 0x2a876198
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a8761bd
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + 0x2a98cc18]
mov eax, dword [ebp - 0x10]
jmp 0x2a8761bf
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a87612f
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a8761dd
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a863507
mov eax, esi
call fcn.2a84aa52
ret

Function at 0x2a878715
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a985ae9
call fcn.2a8ca9a7
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a878779
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a84e949
mov eax, esi
call fcn.2a8ca985
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a863507
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a86a7ea
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a869ec4
push 0x2a9f32e4
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a87df87
Capabilities:
Get socket status

Disassembly:
push 0x198
mov eax, 0x2a986702
call fcn.2a8ca9a7
mov eax, dword [ecx + 0x10004]
xor esi, esi
mov dword [ebp - 0x194], 0x1e
mov dword [ebp - 0x190], esi
cmp eax, 0xffffffff
je 0x2a87dff3
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x188], eax
push ecx
inc eax
mov dword [ebp - 0x18c], 1
lea ecx, [ebp - 0x18c]
push esi
cmp dword [ebp + 8], esi
jne 0x2a87dfdb
push esi
push ecx
jmp 0x2a87dfdd
push ecx
push esi
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x2a87e02b
mov al, al
call fcn.2a8ca985
ret 4
push 0x92
lea ecx, [ebp - 0x1a4]
call fcn.2a863507
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], esi
push ecx
mov ecx, eax
call fcn.2a86a7ea
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.2a863507
push 0x2a9f531c
lea eax, [ebp - 0x58]
jmp 0x2a87e05f
push 0x77
lea ecx, [ebp - 0x19c]
call fcn.2a863507
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.2a86a7ea
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.2a863507
push 0x2a9f531c
lea eax, [ebp - 0x34]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a8bcfd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.2a8cb5a0
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x2a8bd05a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x2a8bd05e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3c8]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.2a894ac0
push eax
call fcn.2a8cdea0
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x2a8bd067
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x2a8bd012
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x14], eax
test eax, eax
je 0x2a8bd0e4
mov eax, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr eax, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x10]
lea edi, [edi - 1]
mov edx, esi
mov ecx, ebp
sub edx, ebp
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebp
movzx ecx, byte [esp + 0x2c]
or dl, al
movzx eax, byte [edi + 1]
dec dl
movzx edx, dl
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
cmp ebp, dword [esp + 0x14]
jb 0x2a8bd0a5
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov eax, ecx
pop ebx
mov dword [edi + 8], esi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret

Function at 0x2a8ca80f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a987d7c
call fcn.2a84a73f
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a863507
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a8ca854
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a8ca856
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a8c9bfd
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a84aa52
ret
Function at 0x2a8e9c90
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.2a863507
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.VCRUNTIME140.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x2a8e9d35
push 0x48
push str.crypto_bio_bss_file.c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 1
push 2
call fcn.2a8d0840
push 0x2a9916a4
push esi
push 0x2a9b39b8
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.2a8cff50
add esp, 0x2c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 2
je 0x2a8e9d12
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 6
je 0x2a8e9d12
lea eax, [edi + 2]
lea ecx, [edi + 0x51]
jmp 0x2a8e9d1c
mov eax, 0x80
mov ecx, 0x4f
push ecx
push str.crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.2a8d0840
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x2a9b3960
call fcn.2a8ce250
mov esi, eax
add esp, 4
test esi, esi
jne 0x2a8e9d57
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.2a8cdbf0
push edi
push ebx
push 0x6a
push esi
call fcn.2a8cdc20
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x40ecd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40ece2
pop dword [ebp - 0x28]
mov eax, 0x40ece2
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xc9e0aca0
sub dword [ebp - 0x38], 0x7b8e6755
mov dword [ebp - 0x34], 0x725c7fe4
sub dword [ebp - 0x34], 0x4029339f
mov dword [ebp - 0x30], 0x8b68c717
add dword [ebp - 0x30], 0xc0e37d17
mov dword [ebp - 0x2c], 0x9106682e
sub dword [ebp - 0x2c], 0x9106682e
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x88cb5b5d
sub dword [ebp - 0x38], 0x1458f207
mov dword [ebp - 0x34], 0x5f33734e
sub dword [ebp - 0x34], 0x1dc711d9
mov dword [ebp - 0x30], 0x8810c0a4
add dword [ebp - 0x30], 0xdb5eabc8
mov dword [ebp - 0x2c], 0x90af1b52
add dword [ebp - 0x2c], 0x6f50e4ae
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xa85baa6e
sub eax, 0xa81b998a
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3dd1a
push 0
call eax
mov ecx, 0x4ab4
xor ebx, ebx
add ebx, eax
mov edx, 0x6e5dcf2e
add edx, 0x91e8f8d2
add edx, dword [ebp - 0x28]
mov edi, 0x89e5449a
xor dword [ebp - 0x14], 0x3ba9c6d2
mov esi, dword [edx]
sub dword [ebp - 4], 0x5fc8c843
xor esi, edi
sub dword [ebp - 0x24], 0x4ee28ccb
mov dword [ebx], esi
add dword [ebp - 0x10], 0xb8b58885
add ebx, 0x138537c0
add ebx, 0xec7ac844
add edx, 0x546822d
add edx, 0xfab97dd7
loop 0x40edf0
add eax, 0x11da3
mov ebx, eax
add eax, 0x63211d4e
sub eax, 0x63211d49
mov ecx, 0x138fb142
add ecx, 0xecb04ebe
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403e59
pop dword [ebp - 0x18]
mov eax, 0x68013638
add eax, 0x983f0821
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x8d13548a
sub dword [ebp - 0x28], 0x3ec10f3f
mov dword [ebp - 0x24], 0x1df6aa98
add dword [ebp - 0x24], 0x143ca1ad
mov dword [ebp - 0x20], 0x8a1c41cf
sub dword [ebp - 0x20], 0x3dcffda1
mov dword [ebp - 0x1c], 0xe36bd214
sub dword [ebp - 0x1c], 0xe36bd214
lea eax, [ebp - 0x28]
push eax
mov eax, 0xbc4b91d4
sub eax, 0xbc0b1148
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2326b42a
add dword [ebp - 0x28], 0x514bb52c
mov dword [ebp - 0x24], 0x470212a8
sub dword [ebp - 0x24], 0x595b133
mov dword [ebp - 0x20], 0x3dd0d847
add dword [ebp - 0x20], 0x259e9425
mov dword [ebp - 0x1c], 0x630d697e
sub dword [ebp - 0x1c], 0x630d697e
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39d05
push 0
call eax
mov ecx, 0x5444
mov edx, eax
mov edi, 0x87e8bcc6
add edi, 0x7858533a
add edi, dword [ebp - 0x18]
mov esi, 0x67d22b4f
sub esi, 0xdf383f34
add dword [ebp - 0x10], 0x2ddf5f3c
mov ebx, dword [edi]
sub dword [ebp - 0xc], eax
add ebx, esi
mov dword [ebp - 0x10], 0x3a3a83f1
mov dword [edx], ebx
xor dword [ebp - 4], 0x39bc8e26
add edx, 0x573819fc
add edx, 0xa8c7e608
add edi, 0x476b8ac4
sub edi, 0x476b8ac0
loop 0x403f70
add eax, 0x6f22caf5
sub eax, 0x6f218712
xor ebx, ebx
add ebx, eax
add eax, 0x89db4e86
add eax, 0x7624b17f
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401770
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x120]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x6f
jne 0x4017e2
mov eax, dword [ebp - 0x14]
push eax
call fcn.00431bf3
add esp, 4
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x401895
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x401895
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x1a0], 0x17
jne 0x401845
mov eax, dword [ebp - 0x38]
add eax, 0x1b0
mov esi, esp
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp esi, esp
call fcn.0043234a
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x64], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x64]
push ecx
call fcn.0041a920
add esp, 4
movzx edx, al
test edx, edx
je 0x401843
mov eax, dword [ebp - 8]
mov byte [eax + 0x5d], 1
jmp 0x401888
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x1a0], 6
jne 0x401888
mov eax, dword [ebp - 0x38]
add eax, 0x1b0
mov esi, esp
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp esi, esp
call fcn.0043234a
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x401888
cmp dword [ebp - 0x44], 0xffffffff
je 0x401888
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0x60], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x5c], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
jmp 0x4017f2
cmp dword [ebp - 0x20], 0
je 0x4018b3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
push ecx
call fcn.004323ff
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x4018d8]
call fcn.0043236d
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x120
cmp ebp, esp
call fcn.0043234a
mov esp, ebp
pop ebp
ret
Function at 0x402e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0xffffffff
jne 0x402e33
xor al, al
jmp 0x402ec6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
and ecx, 0
push ecx
push eax
call fcn.004331eb
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
and eax, 0
mov edx, dword [ebp + 0x10]
mov cl, 0x20
call fcn.00433150
push edx
push eax
call fcn.004331eb
mov dword [ebp - 0x2c], eax
mov esi, esp
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.0043234a
mov esi, esp
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call fcn.004331eb
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.0043234a
test eax, eax
jne 0x402eb6
xor al, al
jmp 0x402ec6
cmp dword [ebp + 0x1c], 0
je 0x402ec4
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x402eed]
call fcn.0043236d
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.0043234a
mov esp, ebp
pop ebp
ret 0x18

Function at 0x409f50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], 0
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0x67452301
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0xefcdab89
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0x98badcfe
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a700
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push 0
push 1
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp esi, esp
call fcn.0043234a
test eax, eax
je 0x41a742
mov al, 1
jmp 0x41a7a0
mov eax, dword [ebp - 8]
add eax, 0x38
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x41a6b0
push 0
push 0
call fcn.00433e6a
add esp, 0x18
mov edx, dword [ebp - 8]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x34], 0
jne 0x41a788
mov esi, esp
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp esi, esp
call fcn.0043234a
xor al, al
jmp 0x41a7a0
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.0043234a
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.0043234a
mov esp, ebp
pop ebp
ret
Function at 0x41afa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [ebp + 0x14], 0
jne 0x41afc9
jmp 0x41b0e1
mov eax, dword [ebp + 0x14]
mov cl, byte [eax + 0x100]
mov byte [ebp - 5], cl
mov eax, dword [ebp + 0x14]
mov cl, byte [eax + 0x101]
mov byte [ebp - 0x11], cl
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], 0
jmp 0x41aff9
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp + 0x10]
jae 0x41b0c9
movzx eax, byte [ebp - 5]
add eax, 1
mov ecx, eax
and ecx, 0x800000ff
jns 0x41b01e
dec ecx
or ecx, 0xffffff00
inc ecx
call fcn.0043316f
mov byte [ebp - 5], al
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 0x11]
add edx, eax
mov ecx, edx
and ecx, 0x800000ff
jns 0x41b049
dec ecx
or ecx, 0xffffff00
inc ecx
call fcn.0043316f
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x11]
add eax, dword [ebp - 0x20]
push eax
movzx ecx, byte [ebp - 5]
add ecx, dword [ebp - 0x20]
push ecx
call fcn.00409d20
add esp, 8
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x20]
movzx edx, byte [ecx + eax]
movzx eax, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x20]
movzx eax, byte [ecx + eax]
add edx, eax
mov ecx, edx
and ecx, 0x800000ff
jns 0x41b093
dec ecx
or ecx, 0xffffff00
inc ecx
call fcn.0043316f
mov byte [ebp - 0x29], al
cmp dword [ebp + 8], 0
je 0x41b0c4
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x38]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 0x29]
mov eax, dword [ebp - 0x20]
movzx edx, byte [eax + edx]
xor ecx, edx
call fcn.0043316f
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x38]
mov byte [ecx], al
jmp 0x41aff0
mov eax, dword [ebp + 0x14]
mov cl, byte [ebp - 5]
mov byte [eax + 0x100], cl
mov eax, dword [ebp + 0x14]
mov cl, byte [ebp - 0x11]
mov byte [eax + 0x101], cl
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.0043234a
mov esp, ebp
pop ebp
ret
Function at 0x422460
Capabilities:
Encode data using xor

Disassembly:
push eax
xor dword [ecx + ebx*8], edx
adc al, 0xd9
imul ebp, edx, 4
mov bh, 0x9c
or dword [ecx - 0x17], ebp
and eax, 0x4f529d03
jno 0x422449
daa
ja 0x4224d6
rcl dword [ebx - 0xa7cc3e9], cl
pop ss
cmp al, 0x83
cmc
jb 0x4224e1
xchg edx, esp
test byte es:[eax + 0x7f7b6108], dh
cmpsb byte [esi], byte es:[edi]
dec esi
jecxz 0x422448
xchg ecx, eax
je 0x42249c
invalid
or al, 0xb7
pushal
sbb byte [edx], al
xor byte [ebx - 0x6c], ch
lea eax, [eax - 0x21]
cmpsb byte [esi], byte es:[edi]
out 0xdb, eax
fdiv qword [eax - 0x63]
fcmovnu st(0), st(4)
jo 0x42244a
arpl word [ebp - 0x77], sp
stosb byte es:[edi], al
mov al, byte [0x353d729f]
xor eax, 0x7f5f3996
lodsb al, byte [esi]
ljmp 0x7cb8
clc
leave
inc eax
salc
shl byte [esi], 1
mov byte [0x468bc574], al
mov edi, 0xdb6f9731
pop ss
xchg edi, eax
outsd dx, dword [esi]
fist dword [edi]
invalid
push ebp
inc ebp
in al, 0x34
xchg byte [eax + 0x73], ch
sar dword [esi + edi*2 - 0x6e], 1
mov byte [0xd3ea01c1], al
mov esi, 0x17aa9cdb
rol dword [eax - 0x79eada4a], 0xba
sub dword [ecx - 0x74d54c72], esp
in eax, dx
outsb dx, byte [esi]
aas
dec esi
mov bh, 0xbe
mov al, 0x96
insd dword es:[edi], dx
dec esi
push cs
sahf
js 0x4224f8
mov dh, 0x25
adc eax, 0xa129ba86
invalid
ja 0x4224c5
mov bl, 0xd7
mov byte [edi - 0x18098c33], 0x77
sub esp, dword [edi + ebx*8]
mov byte [0xfb0cd157], al
jp 0x4224a9
sbb ebx, esp
sub byte [esp + esi*8], dl
and al, 0x50
loope 0x422534
hlt
salc
mov ch, 0x49
push es
mov dword [edx - 0x1d], edx
wait
push edx
jecxz 0x4224d2
sub byte [edi], cl
in al, 0xb3
test ecx, edx
les ebp, [ecx + 0x6fab6cba]
enter 0x742b, 0x42
push es
push es
jae 0x42254f
xchg edx, eax
cwde
adc ebx, edx
jo 0x422548
xlatb
fcmovu st(0), st(7)
xor al, 0xf
test eax, 0x2420cdb7
xor ch, byte [esi + 0x6231662e]
jno 0x42252a
add al, 0x1c
int1
xchg esp, eax
sbb esp, ebp
stc
imul edi, dword [ecx], 0x46
push esi
std
leave
movsb byte es:[edi], byte [esi]
add ebp, esp
in al, dx
and byte [ebx], 0x16
cli
scasb al, byte es:[edi]
dec eax
test dword [esi], esi
invalid
Function at 0x4284e0
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
imul esi, dword [ecx + 0x37], 0x97a045b7
jno 0x428519
mov bh, 0x45
mov al, byte [0xdc2d9a97]
das
inc ecx
invalid
leave
jge 0x42855b
jno 0x428519
mov bh, 0x45
mov al, byte [0xdc2d9a97]
das
inc ecx
test eax, 0x346c7dc9
imul esp, esp, 0xa0a6c5b7
mov cl, 0x8c
dec edi
xor al, 0x69
in al, 0xb7
lds esp, [esi + 0x4f8cb1a0]
pop esp
jg 0x4284dd
pop ss
invalid
in eax, dx
arpl cx, di
stc
test dword [ebp - 0x22317894], 0x898d4e97
aaa
mov dl, 0x27
fisub dword [esi]
sahf
nop
xchg byte [edx + ecx*8 + 0x66fc6900], al
ret 0xbda2
and dh, byte [eax + esi*4]
lds ebp, [eax + 0x24dbff99]
lodsb al, byte [esi]
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
rcr dword [edx - 0x7d5b4ec1], 0x1a
dec eax
jne 0x42851b
cmp eax, 0xae0af003
jno 0x4285a2
hlt
popal
jl 0x42856c
inc edi
aad 0xb3
mov dl, 0xd2
invalid
fdiv dword [ebp + edx*2 + 0x61]
push ebp
popal
jnp 0x42853a
cmp eax, 0x68
lcall 0xcde4, 0x2bef1904
out 2, al
invalid
invalid

Function at 0x42e5f0
Capabilities:
Encode data using xor

Disassembly:
imul ecx, dword [eax - 0x67], 0x8e5b8ed4
xor ebx, ebx
out dx, eax
push cs
repne movsb byte es:[edi], byte [esi]
clc
sub dword [0x34b8f083], edx
cmp byte [edx], ah
enter 0x55a3, 0xffffffffffffff9a
dec esp
std
jecxz 0x42e67d
and eax, 0x34cad64e
mov al, 0x23
adc ah, dh
mov dl, 0x1b
mov eax, dword [0xd8950787]
in al, 0x5b
sbb dh, byte [esi]
test eax, 0x1022107e
daa
sbb ebp, dword [eax]
insd dword es:[edi], dx
fisttp qword [edi]
out dx, eax
popaw
leave
push esi
test esp, edx
jne 0x42e5fa
cmpsd dword [esi], dword es:[edi]
sub al, 0x41
dec esp
cmc
xchg esi, eax
cmp esp, ebp
rol dword [edi], 0x33
int3
daa
mov esi, 0x17c10020
scasb al, byte es:[edi]
pop ss
lodsd eax, dword [esi]
sub byte [edi + 0x432eec26], bl
add eax, 0xeaa24679
stosd dword es:[edi], eax
aaa
jne 0x42e697
dec ecx
sbb byte [ecx], bh
loopne 0x42e69f
cmp eax, esp
add eax, 0x9b2da984
fst qword [edx]
test byte [ecx + 0x12dd9b2d], ch
adc bl, byte [edx + 0x10]
invalid
pop edx
adc dh, al
cdq
inc eax
push edi
sbb al, 0x48
mov ebp, 0x7f56d9a8
test eax, 0x120ca0cc
insb byte es:[edi], dx
jecxz 0x42e6c0
jbe fcn.0042e700
adc dword [edi], 0xffffffbb
cmp dword [eax + 0x3290cd19], ecx
jle 0x42e6e9
pop ss
mov ebx, 0xcd198839
nop
xor bh, byte [esi + 0x26]
push ebx
jle 0x42e6b9
dec ebx
cmp dword [eax], ecx
pop eax
call 0x9237c568
invalid
sub eax, dword [edx]
add byte [eax], al
pop es
xor byte [ecx + eax - 0x325f169a], dh
popfd
stosb byte es:[edi], al
xchg ecx, eax
or ebp, ebp
adc eax, 0xc36782bb
cwde