joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403daf
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x403dd8
test byte [esp + 8], 2
je 0x403dcc
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403dda
xor eax, eax
ret 8

Function at 0x403ef0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x403f2c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x4043b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x404415
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40440d
push dword [esp + 0x10]
push dword [0x728188]
call fcn.00404758
test eax, eax
je 0x404403
cmp dword [eax + 4], 0
je 0x4043f2
push edi
push esi
push eax
call fcn.004044d0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x4044d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4045d7
cmp dword [esi + 0x14], 1
jne 0x40451b
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x404598
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x404583
dec eax
je 0x40456c
sub eax, 2
je 0x404557
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00403ef0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4045c5
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x404541
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4045e0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x404601
push esi
call fcn.00403ef0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x404675
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x404662
dec ecx
je 0x40464d
sub ecx, 2
je 0x40463a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4046ba
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4046db
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x40e0b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
cmp esi, eax
jb 0x40e0c0
mov esi, eax
test esi, esi
je 0x40e152
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
sub ebp, ebx
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov eax, dword [edi + 8]
mov dl, byte [ebx + ebp]
or eax, 2
mov ecx, eax
mov byte [esp + 0x20], dl
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x20]
push 1
push eax
shr ecx, 8
xor cl, dl
mov byte [ebx], cl
mov eax, dword [edi]
not eax
push eax
call fcn.0040ad80
not eax
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [edi + 4], eax
mov al, byte [edi + 7]
mov byte [esp + 0x38], al
lea eax, [esp + 0x38]
push eax
mov eax, dword [edi + 8]
not eax
push eax
call fcn.0040ad80
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [edi + 8], eax
dec esi
jne 0x40e0e0
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret

Function at 0x40e160
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x40e1e5
push ebx
mov ebx, dword [esp + 0x14]
jmp 0x40e190
movzx eax, byte [ebx]
mov byte [esp + 0x10], al
lea eax, [esp + 0x10]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.0040ad80
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.0040ad80
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x40e190
pop ebx
pop edi
xor eax, eax
pop esi
ret

Function at 0x410fb0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
cmp edi, eax
jb 0x410fbf
mov edi, eax
test edi, edi
je 0x41103d
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
sub ebp, ebx
mov eax, dword [esi + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
lea eax, [esp + 0x1c]
push 1
push eax
shr ecx, 8
xor cl, byte [ebx + ebp]
mov byte [ebx], cl
mov eax, dword [esi]
not eax
mov byte [esp + 0x24], cl
push eax
call fcn.0040ad80
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
mov al, byte [esi + 7]
mov byte [esp + 0x34], al
lea eax, [esp + 0x34]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.0040ad80
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x410fd4
pop esi
pop ebp
pop ebx
pop edi
ret
Function at 0x411040
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x24], 0xc
jae 0x411058
mov eax, dword [esp + 0x28]
mov byte [eax], 0xff
or eax, 0xffffffff
add esp, 0x10
ret
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x24]
mov dword [esi], 0x12345678
mov dword [esi + 4], 0x23456789
mov dword [esi + 8], 0x34567890
test edi, edi
je 0x4110d5
push ebx
mov ebx, dword [esp + 0x24]
nop
movzx eax, byte [ebx]
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
push 1
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.0040ad80
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
movzx eax, byte [esi + 7]
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.0040ad80
add esp, 0x18
lea ebx, [ebx + 1]
not eax
mov dword [esi + 8], eax
dec edi
jne 0x411080
pop ebx
push 0xc
lea eax, [esp + 0x10]
push eax
push 0xc
push dword [esp + 0x34]
push esi
call fcn.00410fb0
mov ecx, dword [esp + 0x44]
add esp, 0x14
mov al, byte [esp + 0x17]
pop edi
mov byte [ecx], al
xor eax, eax
pop esi
add esp, 0x10
ret
Function at 0x4181f0
Capabilities:
Terminate process

Disassembly:
push esi
push 0x24
push str.Fatal_Internal_Error_in_libarchive:
push 2
call fcn.0041e440
mov edx, dword [esp + 0x18]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
jmp 0x418210
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418210
sub ecx, esi
push ecx
push edx
push 2
call fcn.0041e440
push 1
push 0x45bfa8
push 2
call fcn.0041e440
add esp, 0x18
push dword [esp + 8]
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
int3
Function at 0x418c40
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 0x30]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 4], 0
mov edi, dword [ebx + 4]
mov ebp, dword [ebx]
lea eax, [edi + 1]
push eax
push esi
call fcn.00419bf0
add esp, 8
test eax, eax
je 0x418c92
test edi, edi
je 0x418c84
mov eax, dword [esi + 4]
add eax, dword [esi]
push edi
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
add dword [esi + 4], edi
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov byte [ecx + eax], 0
jmp 0x418ca1
push str.Out_of_memory
push 1
call fcn.004181f0
add esp, 8
mov dword [esi + 0x10], 0
lea edi, [esi + 0xc]
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
inc eax
add eax, ebp
push eax
push edi
call fcn.00419bf0
add esp, 8
test eax, eax
je 0x418cef
test ebp, ebp
je 0x418ce1
mov eax, dword [edi + 4]
add eax, dword [edi]
push ebp
push dword [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
add dword [edi + 4], ebp
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov byte [ecx + eax], 0
jmp 0x418cfe
push str.Out_of_memory
push 1
call fcn.004181f0
add esp, 8
mov dword [esi + 0x1c], 0
add esi, 0x18
mov edi, dword [ebx + 0x1c]
mov ebx, dword [ebx + 0x18]
mov eax, dword [esi + 4]
inc eax
add eax, edi
add eax, eax
push eax
push esi
call fcn.00419bf0
add esp, 8
test eax, eax
je 0x418d52
test edi, edi
je 0x418d3f
mov ecx, dword [esi + 4]
lea eax, [edi + edi]
push eax
mov eax, dword [esi]
push ebx
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
add dword [esi + 4], edi
xor edx, edx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov word [eax + ecx*2], dx
pop ebx
ret
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 8], str.Out_of_memory
mov dword [esp + 4], 1
jmp fcn.004181f0

Function at 0x4198b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, dword [eax]
push edi
mov edi, dword [eax + 4]
mov eax, dword [esi + 4]
inc eax
add eax, edi
push eax
push esi
call fcn.00419bf0
add esp, 8
test eax, eax
je 0x4198f9
test edi, edi
je 0x4198e9
mov eax, dword [esi + 4]
add eax, dword [esi]
push edi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
add dword [esi + 4], edi
mov ecx, dword [esi + 4]
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov byte [ecx + eax], 0
ret
pop edi
pop esi
pop ebx
mov dword [esp + 8], str.Out_of_memory
mov dword [esp + 4], 1
jmp fcn.004181f0
Function at 0x41dee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__errno]
test eax, 0xffff7fff
jne 0x41dfc4
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41df5d
call ebx
cmp eax, 3
jne 0x41df43
push ebp
call fcn.0041e210
mov esi, eax
add esp, 4
test esi, esi
jne 0x41df37
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41df5d
call ebx
push eax
call fcn.0041de20
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x41dfb8
push 0
push 0x2000001
push 3
push 0
push 0
push 0
test esi, esi
je 0x41df7d
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x41df84
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
cmp edi, 0xffffffff
jne 0x41dfa7
call ebx
push eax
call fcn.0041de20
add esp, 4
or eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push edi
call dword [sym.imp.MSVCRT.dll__open_osfhandle]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
test esi, esi
jne 0x41e05b
mov eax, dword [esp + 0x18]
push dword [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x41e0e9
call edi
cmp dword [eax], 0xd
jne 0x41e031
test dword [esp + 0x18], 0x100
je 0x41e031
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41e00d
call ebx
push eax
call fcn.0041de20
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x41e021
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x15
or eax, 0xffffffff
pop ebx
ret
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0xd
or eax, 0xffffffff
pop ebx
ret
call edi
cmp dword [eax], 2
jne 0x41e0e9
push ebp
call fcn.0041e210
mov esi, eax
add esp, 4
test esi, esi
jne 0x41e05b
call edi
pop edi
pop esi
pop ebp
mov dword [eax], 0x16
or eax, 0xffffffff
pop ebx
ret
push dword [esp + 0x1c]
mov ebp, dword [esp + 0x1c]
push ebp
push esi
call dword [sym.imp.MSVCRT.dll__wopen]
add esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
jns 0x41e0d6
call edi
cmp dword [eax], 0xd
jne 0x41e0d6
test ebp, 0x100
je 0x41e0d6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41e0af
call ebx
push eax
call fcn.0041de20
add esp, 4
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
test al, 0x10
je 0x41e0ce
call edi
push esi
mov dword [eax], 0x15
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
call edi
mov dword [eax], 0xd
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x41e0f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x41e108
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
cmp dword [esp + 0xc], 0
jne 0x41e112
xor eax, eax
ret
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
lea ecx, [esp + 4]
push 0
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41e17a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
jne 0x41e153
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0xb
or eax, 0xffffffff
ret
cmp eax, 0x6d
je 0x41e10f
cmp eax, 5
jne 0x41e16d
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0041de20
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x41e440
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jns 0x41e458
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__get_osfhandle]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41e4a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x41e497
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 9
or eax, 0xffffffff
ret
push eax
call fcn.0041de20
add esp, 4
or eax, 0xffffffff
ret
mov eax, dword [esp + 4]
ret

Function at 0x41e790
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea eax, [esp + 4]
push 0xf0000000
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x41e7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x41e7f7
push 8
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call esi
test eax, eax
je 0x41e7f7
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test esi, esi
je 0x41e7f7
xor eax, eax
pop esi
pop ecx
ret
mov eax, 0xffffffe7
pop esi
pop ecx
ret
Function at 0x446d90
Capabilities:
Encode data using xor

Disassembly:
push edi
call fcn.00446dd0
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
not eax
test edi, edi
je 0x446dc9
push esi
mov esi, dword [esp + 0xc]
lea esp, [esp]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x728194]
dec edi
jne 0x446db0
pop esi
not eax
pop edi
ret
Function at 0x4484f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x727910], 0
push ebx
push esi
push edi
jne 0x44860e
mov byte [0x727910], 1
xor esi, esi
lea esp, [esp]
mov ecx, esi
xor eax, eax
and ecx, 1
mov edx, esi
or ecx, eax
je 0x448530
shrd edx, eax, 1
shr eax, 1
xor edx, 0xd7870f42
xor eax, 0xc96c5795
jmp 0x448536
shrd edx, eax, 1
shr eax, 1
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x448551
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x44856c
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x448587
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4485a2
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4485bd
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4485d8
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov ecx, edx
shrd edx, eax, 1
and ecx, 1
shr eax, 1
or ecx, 0
je 0x4485f3
xor edx, 0xd7870f42
xor eax, 0xc96c5795
mov dword [esi*8 + 0x727918], edx
mov dword [esi*8 + 0x72791c], eax
inc esi
cmp esi, 0x100
jb 0x448510
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
not ebx
mov edi, dword [esp + 0x14]
not edx
test edi, edi
je 0x448649
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
shrd ebx, edx, 8
xor ecx, eax
shr edx, 8
xor ebx, dword [ecx*8 + 0x727918]
xor edx, dword [ecx*8 + 0x72791c]
dec edi
jne 0x448626
pop edi
not ebx
not edx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x405fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, eax
push 0xdd4a34
push edi
call fcn.0040947f
mov esi, eax
add esp, 8
test esi, esi
je 0x406003
push ebx
push 2
push 0
push esi
call fcn.004098ea
push esi
call fcn.004097fb
push 0
push 0
push esi
mov ebx, eax
call fcn.004098ea
push esi
call fcn.004099d3
add esp, 0x20
cmp ebx, 0x7d000
pop ebx
jle 0x406003
push edi
call fcn.00409a47
add esp, 4
push 0xdd4a38
push edi
call fcn.0040947f
mov esi, eax
add esp, 8
test esi, esi
jne 0x40601e
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406026
push esi
sub eax, edi
push eax
push 1
push edx
call fcn.004095ed
push esi
call fcn.004099d3
add esp, 0x14
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4078b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [0xdd1034]
test eax, eax
jne 0x4078cf
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x1c]
push 0x104
push ecx
push esi
call dword [0xdd10a8]
test eax, eax
jne 0x4078ed
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
movzx edx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [edx + eax + 0x18]
movzx eax, word [eax + 6]
push ebx
sub edi, esi
xor ebx, ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x407931
lea eax, [ecx + 0x10]
mov edi, edi
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ecx, dword [eax - 4]
cmp edx, esi
ja 0x40791e
mov edx, esi
cmp edi, ecx
jb 0x407928
add edx, ecx
cmp edi, edx
jbe 0x40793a
inc ebx
add eax, 0x28
cmp ebx, dword [ebp - 4]
jb 0x407910
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
inc ebx
mov dword [eax], ebx
sub edi, ecx
mov ecx, dword [ebp + 0x10]
pop ebx
pop esi
mov dword [ecx], edi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret