joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40875b
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x244
lea ebp, [esp - 4]
mov eax, dword [0x458220]
xor eax, ebp
mov dword [ebp + 0x244], eax
push 0x28
mov eax, 0x44496a
call fcn.004384b9
lea eax, [ebp]
mov edi, ecx
push 0x5087
push eax
mov dword [ebp - 0x18], edi
call fcn.00402be4
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x4087a4
lea eax, [ebp + 4]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 4]
call esi
push 0x20a
lea eax, [ebp + 0x38]
push 0
push eax
call fcn.00436290
add esp, 0xc
push 0x3ec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x10], eax
je 0x40881d
push eax
call ebx
test eax, eax
je 0x40881d
push 0x104
lea eax, [ebp + 0x38]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40881d
and word [ebp + 0x240], 0
lea eax, [ebp + 0x38]
push eax
call fcn.0043634f
pop ecx
lea esi, [edi + 0x230]
lea ecx, [ebp + 0x38]
call fcn.004011a5
jmp 0x408840
push dword [ebp - 0x10]
call ebx
test eax, eax
je 0x408840
lea eax, [edi + 0x230]
cmp dword [eax + 0x18], 8
jb 0x408837
mov eax, dword [eax + 4]
jmp 0x40883a
add eax, 4
push eax
push dword [ebp - 0x10]
call esi
add edi, 0x230
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x10], edi
call fcn.0042f6da
push 0xffffffffffffffff
push edi
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.00401223
push ebx
push 1
lea esi, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040115e
push 0x447ea4
mov eax, edi
call fcn.0040c5cf
mov esi, dword [ebp - 0x18]
cmp byte [esi + 0x98], bl
pop ecx
je 0x408920
cmp dword [esi + 0x90], ebx
je 0x408920
lea ecx, [esi + 0x7c]
mov eax, edi
call fcn.0040c41d
test eax, eax
je 0x408920
lea eax, [esi + 0x298]
lea esi, [ebp + 0x1c]
call fcn.00403959
mov byte [ebp - 4], 2
call fcn.0040c698
push 0x3a
call fcn.0040c545
push 0x5c
call fcn.0040c545
pop ecx
pop ecx
mov edi, 0x4484f4
push edi
lea eax, [ebp - 0x34]
call fcn.0040392d
lea eax, [ebp - 0x34]
call fcn.0040152f
push ebx
push 1
lea esi, [ebp - 0x34]
mov byte [ebp - 0x11], al
call fcn.0040115e
cmp byte [ebp - 0x11], bl
je 0x408915
push edi
lea eax, [ebp - 0x34]
call fcn.0040392d
mov ecx, dword [ebp - 0x10]
lea edi, [ebp + 0x1c]
lea eax, [ebp - 0x34]
call fcn.0040166a
push ebx
push 1
lea esi, [ebp - 0x34]
call fcn.0040115e
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.0040115e
push ebx
push 1
lea esi, [ebp]
call fcn.0040115e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x244]
xor ecx, ebp
call fcn.004363e5
add ebp, 0x248
leave
ret
Function at 0x40a199
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete

Disassembly:
push ebp
sub esp, 0x434
lea ebp, [esp - 4]
mov eax, dword [0x458220]
xor eax, ebp
mov dword [ebp + 0x434], eax
push 0x40
mov eax, 0x4433c5
call fcn.004384b9
mov esi, 0x208
xor ebx, ebx
push esi
lea eax, [ebp + 0x22a]
push ebx
push eax
mov word [ebp + 0x228], bx
call fcn.00436290
push esi
lea eax, [ebp + 0x1e]
push ebx
push eax
mov word [ebp + 0x1c], bx
call fcn.00436290
add esp, 0x18
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], bx
mov esi, 0x104
push esi
lea eax, [ebp + 0x228]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40a354
push esi
lea eax, [ebp + 0x228]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40a354
push esi
lea eax, [ebp + 0x1c]
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40a354
mov esi, str._c_del
push esi
mov word [ebp + 0x430], bx
mov word [ebp + 0x224], bx
call fcn.0043634f
pop ecx
mov ecx, esi
lea esi, [ebp]
call fcn.004011a5
mov esi, 0x447ea8
push esi
lea eax, [ebp]
push eax
call fcn.00403978
lea eax, [ebp + 0x228]
push eax
lea eax, [ebp]
push eax
call fcn.00403978
push esi
lea eax, [ebp]
push eax
call fcn.00403978
push str.__nul
lea eax, [ebp]
push eax
call fcn.00403978
cmp dword [ebp + 0x18], 8
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], str.Open
jae 0x40a2c5
lea eax, [ebp + 4]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x48], 0x8040
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40a354
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0x40
push dword [ebp - 0x14]
call esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
lea eax, [ebp + 0x228]
push eax
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov byte [ebp - 0xd], 1
push ebx
push 1
lea esi, [ebp]
call fcn.0040115e
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x434]
xor ecx, ebp
call fcn.004363e5
add ebp, 0x438
leave
ret
mov byte [ebp - 0xd], bl
jmp 0x40a323
Function at 0x40bd02
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x20
mov eax, 0x4423f4
call fcn.00438522
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x2c]
call fcn.00403959
and dword [ebp - 4], 0
mov eax, esi
push 0x447ea8
push eax
call fcn.0040c63e
push 0x44867c
mov eax, esi
call fcn.0040c5cf
mov eax, dword [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x14], 8
jae 0x40bd45
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40bd6b
test al, 0x10
je 0x40bd6b
mov bl, 1
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.0040115e
mov al, bl
call fcn.004385a5
ret
xor bl, bl
jmp 0x40bd57
Function at 0x40d079
Capabilities:
Move file

Disassembly:
jmp 0x40edb0
cmp dword [eax + 0x18], 8
jb 0x40edbb
mov eax, dword [eax + 4]
jmp 0x40edbe
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x40edc9
mov ecx, dword [ecx + 4]
jmp 0x40edcc
add ecx, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
ret

Function at 0x40d07e
Capabilities:
Delete directory

Disassembly:
jmp 0x40edda
cmp dword [eax + 0x18], 8
jb 0x40ede5
mov eax, dword [eax + 4]
jmp 0x40ede8
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
ret

Function at 0x40d083
Capabilities:
Create directory

Disassembly:
jmp 0x40edf5
cmp dword [eax + 0x18], 8
jb 0x40ee00
mov eax, dword [eax + 4]
jmp 0x40ee03
add eax, 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
ret

Function at 0x40d09c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x4c
mov eax, 0x443d73
call fcn.00438522
mov esi, 0x4486a8
push esi
mov edi, ecx
call fcn.0043634f
pop ecx
push eax
push esi
mov eax, edi
call fcn.0040d36f
cmp eax, 0xffffffff
jne 0x40d0e5
cmp dword [edi + 0x18], 8
jb 0x40d0cf
mov edi, dword [edi + 4]
jmp 0x40d0d2
add edi, 4
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x40d106
lea eax, [ebp - 0x58]
call fcn.0040d873
and dword [ebp - 4], 0
push eax
push edi
call fcn.0040d83d
pop ecx
mov bl, al
pop ecx
lea eax, [ebp - 0x58]
call fcn.0040d8a1
mov al, bl
call fcn.004385a5
ret

Function at 0x40e38c
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [edi]
push ebx
xor ebx, ebx
cmp eax, ebx
jne 0x40e399
xor al, al
pop ebx
ret
cmp dword [eax + 4], ebx
je 0x40e395
push esi
lea ecx, [eax + 0xc]
push ecx
push 4
push eax
push 0x40e2d6
push ebx
push ebx
call fcn.00437c46
mov ecx, dword [edi]
mov dword [ecx + 0x10], eax
mov eax, dword [edi]
add esp, 0x18
cmp dword [eax + 0x10], ebx
jne 0x40e3d0
or dword [eax + 0x10], 0xffffffff
mov esi, dword [edi]
call fcn.0040e319
xor al, al
jmp 0x40e3f2
mov byte [eax + 8], 1
mov eax, dword [edi]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40e3f0
mov esi, dword [edi]
call fcn.0040e319
mov eax, dword [edi]
mov byte [eax + 8], bl
mov al, 1
pop esi
pop ebx
ret

Function at 0x40ed91
Capabilities:
Set file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x40ed9c
mov eax, dword [eax + 4]
jmp 0x40ed9f
add eax, 4
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
ret
Function at 0x40ee17
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 8
jb 0x40ee2e
add edi, 4
mov eax, dword [edi]
jmp 0x40ee33
add edi, 4
mov eax, edi
push ebx
push esi
push eax
lea eax, [ebp - 0x1c]
call fcn.0040392d
push 0
lea eax, [ebp - 0x1c]
call fcn.0040ed91
pop ecx
mov bl, al
neg bl
push 0
sbb bl, bl
push 1
lea esi, [ebp - 0x1c]
inc bl
call fcn.0040115e
pop esi
test bl, bl
pop ebx
je 0x40ee67
xor al, al
jmp 0x40ee7e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x40ee72
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop edi
leave
ret

Function at 0x40ee9b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x458220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push 0x20a
lea eax, [ebp - 0x20e]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x210], bx
call fcn.00436290
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x40ef67
push edi
push 0x410
lea eax, [ebp - 0x622]
push ebx
push eax
mov word [ebp - 6], bx
mov word [ebp - 0x624], bx
call fcn.00436290
add esp, 0xc
mov edi, 0x208
push edi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, edi
pop edi
ja 0x40ef4b
cmp eax, ebx
je 0x40ef4b
mov word [ebp + eax*2 - 0x624], bx
lea eax, [ebp - 0x624]
push eax
call fcn.0043634f
pop ecx
lea ecx, [ebp - 0x624]
jmp 0x40ef5e
lea eax, [ebp - 0x210]
push eax
call fcn.0043634f
pop ecx
lea ecx, [ebp - 0x210]
call fcn.004011a5
mov al, 1
jmp 0x40ef69
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004363e5
leave
ret

Function at 0x40ef77
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x458220]
xor eax, ebp
mov dword [ebp + 0x190], eax
mov eax, dword [ebp + 0x19c]
push ebx
push esi
push edi
xor esi, esi
push 0x20a
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x7a]
push esi
push eax
mov ebx, ecx
mov edi, edx
mov word [ebp - 0x7c], si
call fcn.00436290
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x40efc5
mov edi, dword [edi + 4]
jmp 0x40efc8
add edi, 4
cmp dword [ebx + 0x18], 8
jb 0x40efd3
mov ebx, dword [ebx + 4]
jmp 0x40efd6
add ebx, 4
lea eax, [ebp - 0x7c]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jbe 0x40f007
lea eax, [ebp - 0x7c]
push eax
mov word [ebp + 0x18e], si
call fcn.0043634f
mov esi, dword [ebp - 0x80]
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004011a5
mov al, 1
jmp 0x40f009
xor al, al
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363e5
add ebp, 0x194
leave
ret

Function at 0x40f105
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40f10d
mov dword [ecx*4 + 0x460460], eax
inc ecx
cmp ecx, 0x100
jb 0x40f108
pop esi
ret
Function at 0x40f3eb
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40f418
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f418
xor al, al
jmp 0x40f433
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00440a10
xor ecx, ecx
add eax, edi
adc edx, ecx
mov dword [esi], eax
mov dword [esi + 4], edx
mov al, 1
pop edi
leave
ret 4

Function at 0x40f530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
push ebx
push esi
jbe 0x40f545
mov dword [ebp + 0xc], eax
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x20], ebx
je 0x40f609
jmp 0x40f601
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 4], ecx
jae 0x40f609
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
lea esi, [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.0040f3eb
test al, al
jne 0x40f5a7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push ebx
push dword [ebp - 0xc]
mov eax, edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0040e0f0
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xc], esp
call fcn.00403959
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp eax, ebx
jne 0x40f609
mov ecx, dword [ebp + 8]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
add eax, ecx
push eax
push dword [edi]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 8]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
add dword [ebp - 4], ecx
cmp eax, ebx
jne 0x40f579
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
pop esi
mov dword [ecx], edx
pop ebx
leave
ret 0xc
Function at 0x4210d4
Capabilities:
Hash data using crc32b

Disassembly:
xor ecx, ecx
mov eax, ecx
push 8
shl eax, 0x18
pop edx
test eax, eax
jns 0x4210eb
add eax, eax
xor eax, 0x4c11db7
jmp 0x4210ed
add eax, eax
dec edx
test edx, edx
jg 0x4210de
mov dword [ecx*4 + 0x45cc28], eax
inc ecx
cmp ecx, 0x100
jb 0x4210d6
ret
Function at 0x42f62d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x458220]
xor eax, ebp
mov dword [ebp + 0x394], eax
push esi
push edi
xor edi, edi
push 0x40e
lea eax, [ebp - 0x7a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x7c], di
call fcn.00436290
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3a0]
mov dword [ebp - 0x80], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x42f680
xor al, al
jmp 0x42f6c3
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x42f6a1
cmp dword [ebp - 0x80], edi
je 0x42f67c
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x42f67c
lea eax, [ebp - 0x7c]
push eax
call fcn.0043634f
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.004011a5
cmp dword [ebp - 0x80], edi
je 0x42f6c1
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.004363e5
add ebp, 0x398
leave
ret

Function at 0x42f6da
Capabilities:
Query environment variable

Disassembly:
push 0x2c
mov eax, 0x442333
call fcn.00438522
push 1
lea eax, [ebp - 0x30]
mov esi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x30], ebx
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x25
call fcn.00403b53
cmp eax, 0xffffffff
mov eax, edi
jne 0x42f719
call fcn.00403959
mov eax, esi
jmp 0x42f7bb
lea esi, [ebp - 0x2c]
call fcn.00403959
mov dword [ebp - 4], ebx
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 0x38], eax
jb 0x42f732
mov eax, dword [eax]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x42f747
mov eax, edi
jmp 0x42f7a4
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043608b
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
pop ecx
jb 0x42f76d
mov eax, dword [eax]
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x30]
push eax
call ebx
test eax, eax
jbe 0x42f798
cmp eax, esi
ja 0x42f798
mov esi, dword [ebp - 0x30]
and word [esi + eax*2], 0
push esi
call fcn.0043634f
pop ecx
mov ecx, esi
lea esi, [ebp - 0x2c]
call fcn.004011a5
push dword [ebp - 0x30]
call fcn.00436b45
pop ecx
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
call fcn.00403959
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.0040115e
mov eax, dword [ebp - 0x34]
call fcn.004385a5
ret
Function at 0x43118d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x43119b
and dword [esi], 0
and dword [ebp + 0x10], 0
xor eax, eax
inc eax
cmp dword [ebp + 0xc], 0
jbe 0x4311d7
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x4311b5
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x4311d7
mov ecx, dword [ebp + 0x10]
add dword [esi], ecx
test eax, eax
setne al
push eax
call fcn.0040cd60
pop ecx
pop esi
pop ebp
ret 0xc

Function at 0x4317c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
sub esp, 0xc
xor eax, eax
and edx, 7
cmp ecx, 5
push edi
mov edi, dword [ebp + 8]
jb 0x43190e
add dword [ebp + 0xc], 5
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + ecx - 4]
push ebx
mov dword [ebp - 8], ecx
push esi
lea esi, [eax + edi]
jmp 0x4317fe
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x431803
inc esi
cmp esi, dword [ebp - 8]
jb 0x4317f5
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 8]
jae 0x4318ef
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x431882
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp - 4], eax
je 0x43182f
cmp cl, 0xff
jne 0x4318b1
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
sub edi, eax
sub edi, dword [ebp + 0xc]
test edx, edx
mov ebx, edi
mov dword [ebp - 0xc], ebx
je 0x4318c2
movzx edi, byte [edx + 0x448278]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
shr ebx, cl
test bl, bl
je 0x431872
cmp bl, 0xff
jne 0x4318bf
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, dword [ebp - 0xc]
jmp 0x43184a
dec ecx
shl edx, cl
and edx, 7
je 0x43181c
movzx ecx, byte [edx + 0x448278]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x448270], 0
mov cl, byte [ebx + 4]
je 0x4318ae
test cl, cl
je 0x4318ae
cmp cl, 0xff
jne 0x43181c
mov dword [ebp - 4], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4317f0
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x4317f0
mov esi, eax
sub esi, dword [ebp - 4]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
and ecx, edx
mov edx, dword [ebp + 0x10]
pop esi
mov dword [edx], ecx
pop ebx
pop edi
leave
ret

Function at 0x433a2e
Capabilities:
Hash data using sha256

Disassembly:
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x433d15
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
movzx ecx, byte [eax + str.cw]
mov byte [ecx + 0x45f028], al
inc eax
cmp eax, 0x100
jb 0x433d1d
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov esi, 0xff
movzx ebx, byte [edi + str.cw]
mov eax, ebx
and al, 0x80
neg al
lea ecx, [ebx + ebx]
sbb eax, eax
and eax, 0x1b
xor eax, ecx
and eax, esi
mov ecx, eax
mov edx, ecx
xor edx, ebx
mov dword [ebp - 8], edx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ebx
shl edx, 8
or edx, ecx
mov eax, edi
shl eax, 2
mov dword [eax + 0x45d028], edx
mov edx, ebx
shl edx, 8
mov edi, edx
or edi, ebx
or edx, ecx
shl edi, 8
or edi, ecx
shl edx, 8
or edx, dword [ebp - 8]
shl edi, 8
or edi, dword [ebp - 8]
shl ecx, 8
or ecx, dword [ebp - 8]
shl edx, 8
shl ecx, 8
mov dword [eax + 0x45d428], edi
mov edi, dword [ebp - 0x10]
movzx ebx, byte [edi + str.cw]
or edx, ebx
or ecx, ebx
mov dword [eax + 0x45d828], edx
shl ecx, 8
or ecx, ebx
mov dword [eax + 0x45dc28], ecx
movzx ecx, byte [edi + 0x45f028]
mov edx, ecx
and dl, 0x80
neg dl
lea ebx, [ecx + ecx]
mov dword [ebp - 0x18], ecx
sbb edx, edx
and edx, 0x1b
xor edx, ebx
and edx, esi
mov ebx, edx
and bl, 0x80
neg bl
mov dword [ebp - 0x10], edx
sbb ebx, ebx
and ebx, 0x1b
add edx, edx
xor ebx, edx
and ebx, esi
mov edx, ebx
and bl, 0x80
neg bl
mov dword [ebp - 0x14], edx
sbb ebx, ebx
add edx, edx
and ebx, 0x1b
xor ebx, edx
and ebx, esi
mov edx, ebx
xor edx, ecx
mov dword [ebp - 8], edx
mov edx, ebx
xor edx, dword [ebp - 0x10]
xor edx, ecx
mov dword [ebp - 0xc], edx
shl edx, 8
mov ecx, ebx
xor ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
xor ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
or edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x10]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
mov dword [eax + 0x45e028], edx
mov edx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, dword [ebp - 0xc]
mov dword [eax + 0x45e428], edx
mov edx, dword [ebp - 8]
shl edx, 8
or edx, ecx
shl ecx, 8
or ecx, dword [ebp - 0xc]
shl edx, 8
or edx, dword [ebp - 0xc]
shl ecx, 8
or ecx, dword [ebp - 4]
shl edx, 8
or edx, dword [ebp - 4]
shl ecx, 8
or ecx, dword [ebp - 8]
inc edi
cmp edi, 0x100
mov dword [eax + 0x45e828], edx
mov dword [eax + 0x45ec28], ecx
mov dword [ebp - 0x10], edi
jb 0x433d3f
pop edi
pop esi
pop ebx
leave
ret