joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401280
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
lea eax, [esp + 4]
push eax
push ebx
call fcn.00401470
add esp, 8
test eax, eax
jne 0x401306
push edi
push esi
lea ecx, [esp + 0xc]
push str.installwin32_setup.exe
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
call fcn.00401550
add esp, 4
mov esi, eax
xor edi, edi
push 0x10
mov dword [esi], 0x44
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x2c], edi
mov word [esi + 0x32], di
mov dword [esi + 0x34], edi
call fcn.00401550
add esp, 4
lea edx, [esp + 0xc]
push eax
push esi
push edi
push edi
push 0x4000000
push edi
push edi
push edi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
pop edi
pop ebx
add esp, 0x104
ret
xor eax, eax
pop ebx
add esp, 0x104
ret

Function at 0x401710
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4040c8
push 0x4030a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x407658], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x407654], ecx
shl ecx, 8
add ecx, edx
mov dword [0x407650], ecx
shr eax, 0x10
mov dword [0x40764c], eax
call fcn.00401930
test eax, eax
jne 0x40177a
push 0x1c
call fcn.004018e0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00402db0
call fcn.00402da0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x407b18], eax
call fcn.00402760
mov dword [0x407628], eax
test eax, eax
je 0x4017ad
mov eax, dword [0x407b18]
test eax, eax
jne 0x4017b7
push 0xffffffffffffffff
call fcn.004020c0
add esp, 4
call fcn.004024b0
call fcn.004023c0
call fcn.00402090
mov esi, dword [0x407b18]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x401896
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x4017fe
test al, al
je 0x4017fe
and eax, 0xff
push eax
call fcn.00402360
add esp, 4
test eax, eax
je 0x4017d8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4017d8
cmp byte [esi], 0x22
jne 0x401807
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x401817
cmp al, 0x20
ja 0x401817
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401807
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401838
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40183d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004020c0
jmp 0x40187b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x401807
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401896
Function at 0x4018e0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x407630], 1
jne 0x4018ee
call fcn.00403180
mov eax, dword [esp + 4]
push eax
call fcn.004031c0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402100
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x407688]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x40211f
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x407684], 1
mov byte [0x407680], bl
jne 0x402179
mov ecx, dword [0x407b0c]
test ecx, ecx
je 0x402167
mov esi, dword [0x407b08]
sub esi, 4
cmp esi, ecx
jb 0x402167
mov eax, dword [esi]
test eax, eax
je 0x402160
call eax
mov ecx, dword [0x407b0c]
sub esi, 4
cmp esi, ecx
jae 0x402152
push 0x405014
push 0x405010
call fcn.004021b0
add esp, 8
push 0x40501c
push 0x405018
call fcn.004021b0
add esp, 8
test ebx, ebx
jne 0x4021a0
push ebp
mov dword [0x407688], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x402760
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x407798]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x4027a2
call edi
mov esi, eax
test esi, esi
je 0x40278c
mov eax, 1
jmp 0x40279d
call ebp
mov ebx, eax
test ebx, ebx
je 0x4028af
mov eax, 2
mov dword [0x407798], eax
cmp eax, 1
jne 0x402842
test esi, esi
jne 0x4027bb
call edi
mov esi, eax
test esi, esi
je 0x4028af
cmp word [esi], 0
mov eax, esi
je 0x4027d5
add eax, 2
cmp word [eax], 0
jne 0x4027c3
add eax, 2
cmp word [eax], 0
jne 0x4027c3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x402834
push edi
call fcn.00401550
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402834
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x402826
push ebx
call fcn.004033a0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x4028af
test ebx, ebx
jne 0x402853
call ebp
mov ebx, eax
test ebx, ebx
je 0x4028af
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x40286b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40285b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40285b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00401550
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40288d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4031c0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x407380
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x4031e4
add eax, 8
inc ebp
cmp eax, 0x407410
jb 0x4031d5
cmp ecx, dword [ebp*8 + 0x407380]
jne 0x40338b
mov eax, dword [0x407630]
cmp eax, 1
je 0x40334d
test eax, eax
jne 0x403210
cmp dword [0x4051b4], 1
je 0x40334d
cmp ecx, 0xfc
je 0x40338b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40324b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x403294
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x4043a8
add ebx, ecx
push ebx
call fcn.00403820
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x404388
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x407384]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00403790
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x407a00]
test eax, eax
je 0x40335e
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x403368
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x407384]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x5080dd
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ed00e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5321c0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esi + 0x258], edi
mov dword [esi + 0x25c], edi
mov eax, dword [0x53acf4]
mov ecx, 0x53acf4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x38], edi
mov ebx, 0x4fa2b0
push ebx
mov edi, 0x53bdc0
push edi
push 0x50de70
lea eax, [esp + 0x20]
call fcn.004fb6a0
add esp, 0xc
push dword [esp + 0x14]
call dword [fcn.004f6318]
cmp eax, 0xffffffff
jne 0x508191
push 0
call 0x5bab10
pop ecx
push 0
push 0x64
push edx
push eax
call 0x5c6380
test eax, eax
jne 0x508182
test edx, edx
jne 0x508182
mov dword [esi + 0x258], 1
mov dword [esi + 0x25c], 1
jmp 0x508278
lea eax, [esp + 0x20]
call fcn.004fb3dc
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 1
call fcn.004f8ac8
test eax, eax
je 0x5081be
push ebx
push edi
lea eax, [esp + 0x28]
push eax
call fcn.00508390
xor edi, edi
cmp eax, edi
jne 0x5081cc
lea esi, [esp + 0x20]
call fcn.005084ed
jmp 0x50826f
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
lea eax, [esp + 0x18]
push eax
push 0x4fa764
lea ecx, [esp + 0x28]
mov byte [esp + 0x40], 2
call fcn.005083f0
test eax, eax
jne 0x508203
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00508457
test eax, eax
je 0x508253
push edi
push 0x50efc4
lea ecx, [esp + 0x20]
call fcn.004fae89
cmp eax, edi
jne 0x508245
push edi
call 0x5bab10
pop ecx
push edi
push 0x64
push edx
push eax
call 0x5c6380
cmp eax, edi
jne 0x508239
cmp edx, edi
jne 0x508239
mov dword [esi + 0x258], 1
mov dword [esi + 0x25c], 1
jmp 0x508253
xor ecx, ecx
cmp eax, 2
sete cl
mov dword [esi + 0x258], ecx
lea esi, [esp + 0x20]
call fcn.005084ed
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x50826f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x20]
call fcn.004fb3c5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.004f7bea
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x508502
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push esi
xor esi, esi
cmp dword [0x5394c8], esi
mov ebx, eax
jne 0x508517
mov dword [0x5394c8], esi
push dword [esp + 8]
lea eax, [ebx + 0x20]
push eax
push 0x539498
call fcn.005006ee
add esp, 0xc
movzx eax, ax
push eax
push esi
push esi
push 0x80000000
push esi
xor eax, eax
push eax
push esi
call fcn.00534908
push 0x11
push 2
push 2
call dword [0x4f660c]
cmp eax, 0xffffffff
mov dword [ebx + 0x24], eax
jne 0x50855b
xor eax, eax
pop esi
pop ebx
pop ecx
ret
push 1
push 0x84c
push dword [ebx + 4]
push eax
call dword [0x4f6610]
cmp eax, 0xffffffff
je 0x508555
pop esi
mov ecx, ebx
pop ebx
add esp, 4
jmp fcn.00508a5b
Function at 0x50d81e
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
cmp eax, ecx
jne 0x50d828
xor eax, eax
inc eax
ret
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret

Function at 0x50da82
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x1c]
mov byte [ecx + eax + 0x20], 0x80
inc dword [eax + 0x1c]
cmp ecx, 0x37
mov ecx, dword [eax + 0x1c]
jle 0x50dacc
jmp 0x50daa2
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x40
jl 0x50da97
call fcn.0050d8cd
jmp 0x50dab9
mov ecx, dword [eax + 0x1c]
mov byte [eax + ecx + 0x20], 0
inc dword [eax + 0x1c]
cmp dword [eax + 0x1c], 0x38
jl 0x50daae
jmp 0x50dad1
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x38
jl 0x50dac1
mov ecx, dword [eax + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x58], dl
mov edx, ecx
shr ecx, 8
mov byte [eax + 0x5a], cl
mov cl, byte [eax + 0x18]
shr edx, 0x10
mov byte [eax + 0x5b], cl
mov ecx, dword [eax + 0x14]
mov byte [eax + 0x59], dl
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x5c], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [eax + 0x5e], cl
mov cl, byte [eax + 0x14]
mov byte [eax + 0x5d], dl
mov byte [eax + 0x5f], cl
jmp fcn.0050d8cd
Function at 0x5263b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x510968
push dword [ebp + 8]
mov edi, ecx
call dword [fcn.004f6308]
test eax, eax
jne 0x52647f
and dword [ebp - 4], eax
mov eax, dword [edi]
push 0x51073c
mov ecx, edi
call dword [eax + 0x14]
mov esi, eax
test esi, esi
jne 0x52642d
lea esi, [edi + 4]
mov eax, esi
call fcn.0050b3c5
test eax, eax
jbe 0x526477
mov eax, esi
call fcn.0050b3c5
test eax, eax
ja 0x526405
call 0x5b9e21
mov eax, dword [esi + 4]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp eax, 1
jne 0x526477
mov eax, esi
call fcn.0050b3c5
test eax, eax
ja 0x526424
call 0x5b9e21
mov eax, dword [esi + 4]
mov esi, dword [eax]
test esi, esi
je 0x526477
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [eax + 0x20]
push 0
push 0x539a60
push 0x5395d0
push 0
push esi
mov dword [ebp - 4], eax
call 0x5bb985
and dword [eax + 0x48], 0
and dword [eax + 0x44], 0
movzx ecx, word [edi + 0x40]
mov eax, dword [esi]
add esp, 0x14
push ecx
movzx ecx, word [edi + 0x3c]
push ecx
mov ecx, esi
call dword [eax + 0x10]
mov dword [edi + 0x74], 1
mov eax, dword [ebp - 4]
jmp 0x526519
mov ecx, dword [ebp + 8]
push 4
mov edx, 0x510768
pop esi
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x5264ae
test ax, ax
je 0x5264aa
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x5264ae
add ecx, esi
add edx, esi
test ax, ax
jne 0x52648a
xor eax, eax
jmp 0x5264b3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5264c9
push dword [ebp + 0x10]
push edi
call fcn.005265fd
mov dword [edi + 0x74], 1
jmp 0x526517
mov eax, dword [ebp + 8]
mov ecx, 0x510758
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x5264f5
test dx, dx
je 0x5264f1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x5264f5
add eax, esi
add ecx, esi
test dx, dx
jne 0x5264d1
xor eax, eax
jmp 0x5264fa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x526517
mov eax, dword [edi + 0x78]
mov esi, dword [eax]
lea eax, [edi + 0x30]
push eax
call fcn.00520f6c
mov ecx, dword [edi + 0x78]
push 0
push 3
push dword [eax]
call dword [esi]
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x40629d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42275c], 0
jne 0x4062db
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4062b1
mov dword [ecx*4 + 0x422758], eax
inc ecx
cmp ecx, 0x100
jl 0x4062ac
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406308
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4062e9
not eax
pop ebp
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401050
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 4]
test eax, eax
lea esi, [ebx + 4]
push edi
jne 0x401081
mov edi, dword [0x44b008]
push 0
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x401081
push 8
push 1
push eax
push eax
push esi
call edi
test eax, eax
je 0x4010b6
mov eax, dword [ebx + 8]
test eax, eax
lea edi, [ebx + 8]
je 0x401092
push eax
call dword [0x44b02c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
push edi
push 0
push 0
push eax
push ecx
push edx
call dword [0x44b00c]
test eax, eax
je 0x4010b6
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
call dword [0x44b37c]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4010d0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x401164
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x401164
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x8003
push eax
mov dword [esp + 0x18], 0
call dword [0x44b01c]
test eax, eax
je 0x40116e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push 0
push edx
push eax
push ecx
call dword [0x44b018]
test eax, eax
je 0x40116e
mov edx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push 0
push 0
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [0x44b014]
test eax, eax
mov eax, dword [esp + 4]
je 0x401159
test eax, eax
je 0x401152
push eax
call dword [0x44b010]
xor eax, eax
pop esi
pop ecx
ret 0x10
test eax, eax
je 0x401164
push eax
call dword [0x44b010]
mov eax, 0x80004005
pop esi
pop ecx
ret 0x10
call dword [0x44b37c]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x401185
push eax
call dword [0x44b010]
mov eax, esi
pop esi
pop ecx
ret 0x10

Function at 0x4012c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
test edi, edi
jle 0x401306
push ebx
push esi
mov esi, dword [esp + 0x10]
jmp 0x4012e0
mov bl, byte [eax + esi]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov edx, ecx
shr edx, 0x10
add dl, 2
xor dl, bl
xor dl, 0x26
mov byte [eax + esi], dl
inc eax
cmp eax, edi
jl 0x4012e0
pop esi
pop ebx
pop edi
ret
Function at 0x402650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x448628
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x28], edi
call fcn.00402530
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00402210
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4026e2
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4079c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x4079d0
mov eax, 0x17
pop edi
ret
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
mov dword [edx], 0xffffffff
jbe 0x407a0c
push ebx
push ebp
mov eax, dword [edx]
movzx ebx, byte [ecx + edi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x45c0f8]
shr eax, 8
xor eax, ebp
inc ecx
cmp ecx, esi
mov dword [edx], eax
jb 0x4079e7
pop ebp
pop ebx
mov eax, dword [edx]
not eax
pop esi
mov dword [edx], eax
xor eax, eax
pop edi
ret
Function at 0x40d160
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x80c
mov eax, dword [0x45d874]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x814]
push ebp
push esi
xor ebp, ebp
push edi
mov dword [esp + 0x818], eax
mov edi, ecx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], ebp
nop
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d1af
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x10], eax
jge 0x40d340
inc dword [edi + 0xec]
mov eax, dword [ebx + 4]
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
cmp ecx, 0x10
jb 0x40d1d2
mov eax, dword [eax + 4]
jmp 0x40d1d5
add eax, 4
push eax
call dword [0x44b3e4]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40d1e1
sub ecx, esi
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.00404f00
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40d210
mov ecx, dword [edi + 0xcc]
push 0
push ecx
push 0x4401
push eax
call dword [0x44b580]
mov eax, dword [ebx + 4]
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
mov esi, 0x10
cmp ecx, esi
jb 0x40d227
mov eax, dword [eax + 4]
jmp 0x40d22a
add eax, 4
push eax
call dword [0x44b3d4]
test eax, eax
mov eax, dword [ebx + 4]
je 0x40d2de
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
cmp ecx, esi
jb 0x40d24b
mov eax, dword [eax + 4]
jmp 0x40d24e
add eax, 4
push 0x80
push eax
call dword [0x44b338]
test eax, eax
je 0x40d27e
mov eax, dword [ebx + 4]
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
cmp ecx, esi
jb 0x40d270
mov eax, dword [eax + 4]
jmp 0x40d273
add eax, 4
push eax
call dword [0x44b33c]
test eax, eax
jne 0x40d288
mov dword [esp + 0x14], 0
jmp 0x40d294
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40d334
mov eax, dword [ebx + 4]
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
cmp ecx, esi
jb 0x40d2a6
mov eax, dword [eax + 4]
jmp 0x40d2a9
add eax, 4
push eax
lea edx, [esp + 0x1c]
push 0x44c2b8
push edx
call fcn.0042c4f2
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d2c3
mov ecx, dword [edi + 0x10]
sub eax, edx
test ecx, ecx
je 0x40d334
push ecx
push eax
push 1
lea eax, [esp + 0x24]
push eax
jmp 0x40d32c
mov ecx, dword [eax + ebp + 0x18]
add eax, ebp
cmp ecx, esi
jb 0x40d2ed
mov eax, dword [eax + 4]
jmp 0x40d2f0
add eax, 4
push eax
lea ecx, [esp + 0x41c]
push 0x44c2a0
push ecx
call fcn.0042c4f2
lea eax, [esp + 0x424]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d310
mov ecx, dword [edi + 0x10]
sub eax, edx
test ecx, ecx
je 0x40d334
push ecx
push eax
push 1
lea edx, [esp + 0x424]
push edx
call fcn.0042c761
add esp, 0x10
inc dword [esp + 0x10]
add ebp, 0x1c
jmp 0x40d190
mov ecx, dword [esp + 0x818]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042c5af
add esp, 0x80c
ret 4