joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c350
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.0046b8c0
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x46c364
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x46c3e4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x46c441
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x46c433
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x46c400
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x46c3f0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x46c468
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x46c450
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x46c490
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x46c490
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x46c3e0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0x46c4f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x46c510
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x46c520
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x46c510
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x46c910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x46ca87
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x46c99a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x46c970
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x46c954
cmp edx, 0x10
jae 0x46ca21
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x46c9c0
cmp edx, dword [esp + 0x1c]
jae 0x46ca87
or eax, 8
xor edi, edi
cmp eax, 1
je 0x46ca01
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x46c9d4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 8], eax
jb 0x46c9c0
cmp edx, dword [esp + 0x1c]
jae 0x46ca87
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
mov edi, edi
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x46ca66
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x46ca40
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
jb 0x46ca30
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x477720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c8c61
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x4c], eax
push esi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x64], 0
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, dword [esi]
mov eax, dword [esp + 0x68]
mov edx, dword [esi + 4]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x7c]
lea ecx, [esp + 0xc]
push ecx
lea esi, [edi + 0x20]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x50], eax
call fcn.0041f7f0
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00459ea4
add esp, 0x5c
ret 0x18
Function at 0x47b9e0
Capabilities:
Link many functions at runtime

Disassembly:
xor eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
push 0x4e71a4
mov dword [edi], eax
call ebx
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47ba18
push 0x4e71d8
jmp 0x47bbff
push 0x4e9d7c
call ebx
mov dword [esi + 4], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47ba3e
push 0x4e9d88
jmp 0x47bbff
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e71fc
push eax
call ebx
mov dword [esi + 8], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47ba77
mov dword [0x53b820], 3
push 0x4e9da8
jmp 0x47bc09
mov ecx, dword [esi]
push 0x4e7244
push ecx
call ebx
mov dword [esi + 0xc], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47baaa
mov dword [0x53b820], 3
push 0x4e9ddc
jmp 0x47bc09
mov edx, dword [esi]
push 0x4e7294
push edx
call ebx
mov dword [esi + 0x10], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47badd
mov dword [0x53b820], 3
push 0x4e9e14
jmp 0x47bc09
mov eax, dword [esi + 4]
push 0x4e9e48
push eax
call ebx
mov dword [esi + 0x14], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bb11
mov dword [0x53b820], 3
push 0x4e9e58
jmp 0x47bc09
mov ecx, dword [esi + 4]
push 0x4e9e8c
push ecx
call ebx
mov dword [esi + 0x18], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bb3b
push 0x4e9e94
jmp 0x47bbff
mov edx, dword [esi + 4]
push 0x4e9ec4
push edx
call ebx
mov dword [esi + 0x1c], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bb65
push 0x4e9ed4
jmp 0x47bbff
mov eax, dword [esi + 4]
push 0x4e9f0c
push eax
call ebx
mov dword [esi + 0x20], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bb8c
push 0x4e9f1c
jmp 0x47bbff
mov ecx, dword [esi + 4]
push 0x4e9f54
push ecx
call ebx
mov dword [esi + 0x24], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bbb3
push 0x4e9f6c
jmp 0x47bbff
mov edx, dword [esi + 4]
push 0x4e9fac
push edx
call ebx
mov dword [esi + 0x28], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bbda
push 0x4e9fc4
jmp 0x47bbff
mov eax, dword [esi + 4]
push 0x4ea004
push eax
call ebx
mov dword [esi + 0x2c], eax
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [edi], eax
jns 0x47bc1b
push 0x4ea018
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9d60
call fcn.0045eb40
add esp, 4
mov eax, esi
pop ebx
ret
Function at 0x47c8c0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cb631
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov ebx, ecx
mov edi, 0x10
cmp dword [ebx + 0x18], edi
mov dword [0x53b820], 4
mov dword [0x53b824], 0x4e9a18
jb 0x47c917
mov eax, dword [ebx + 4]
lea esi, [ebx + 4]
mov dword [esp + 0x14], esi
jmp 0x47c920
lea eax, [ebx + 4]
mov dword [esp + 0x14], eax
mov esi, eax
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push eax
push 0x4e2c58
call fcn.0045eb40
add esp, 0x10
cmp dword [ebx + 0x18], edi
mov dword [esp + 0x1c], 0
jb 0x47c943
mov esi, dword [esi]
mov edi, 0x4d868c
lea ecx, [esp + 0x1c]
call fcn.004ab790
test eax, eax
je 0x47c9b2
push 0x4e9a18
call fcn.0045ecd0
mov esi, eax
add esp, 4
test esi, esi
jge 0x47c9b2
cmp dword [ebx + 0x18], 0x10
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9a18
jb 0x47c98a
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
jmp 0x47c98e
mov eax, dword [esp + 0x14]
push eax
push 0x4d8ecc
call fcn.0045eb40
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x1c]
push 0
push eax
push esi
call dword [sym.imp.MSVCR80.dll_fseek]
add esp, 0xc
test eax, eax
je 0x47ca04
push 0x4e9a18
call fcn.0045ecd0
mov ebx, eax
add esp, 4
test ebx, ebx
jge 0x47ca04
push 0x4e9a50
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9a18
call fcn.0045eb40
add esp, 4
jmp 0x47caf0
push ebp
call dword [sym.imp.MSVCR80.dll_malloc]
mov edi, eax
add esp, 4
mov ebx, edi
neg ebx
sbb ebx, ebx
and ebx, 0x7fffbffb
add ebx, 0x80004005
jns 0x47ca4a
push 0x4e9a6c
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9a18
call fcn.0045eb40
add esp, 4
jmp 0x47caf0
push esi
push ebp
push 1
push edi
call dword [sym.imp.MSVCR80.dll_fread]
sub eax, ebp
add esp, 0x10
neg eax
sbb eax, eax
and eax, 0x80004005
mov ebx, eax
jge 0x47ca8a
push 0x4e9a7c
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9a18
call fcn.0045eb40
add esp, 4
jmp 0x47caf0
push 0xc
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
je 0x47caa7
mov eax, edi
mov ecx, ebp
call fcn.0049c560
mov esi, eax
jmp 0x47caa9
xor esi, esi
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], esi
call fcn.0041c800
push esi
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.004014d0
add esp, 0xc
mov edi, dword [esp + 0x3c]
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
call fcn.00405a70
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00453c30
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x47cf70
Capabilities:
Get file size

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
cmp dword [esi + 0x18], 0x10
push edi
lea edi, [esi + 4]
jb 0x47cf86
mov eax, dword [edi]
jmp 0x47cf88
mov eax, edi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x47cff0
push 0x4e9850
call fcn.0045ecd0
mov ebp, eax
add esp, 4
test ebp, ebp
jge 0x47cff0
cmp dword [esi + 0x18], 0x10
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9850
jb 0x47cfd8
mov edi, dword [edi]
push edi
push 0x4e987c
call fcn.0045eb40
add esp, 8
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x47d05b
xor ebx, ebx
mov eax, dword [esp + 0x1c]
mov dword [eax], ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x47d051
push 0x4e9850
call fcn.0045ecd0
mov esi, eax
add esp, 4
test esi, esi
jge 0x47d051
push 0x4e98c4
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9850
call fcn.0045eb40
add esp, 4
test ebx, ebx
mov eax, esi
jge 0x47d053
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x4e9850
call fcn.0045ecd0
mov ebx, eax
add esp, 4
test ebx, ebx
jge 0x47d002
cmp dword [esi + 0x18], 0x10
mov dword [0x53b820], 1
mov dword [0x53b824], 0x4e9850
jb 0x47d08a
mov edi, dword [edi]
push edi
push 0x4e98a8
call fcn.0045eb40
add esp, 8
jmp 0x47d008

Function at 0x47d1c0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ecx
push ebx
mov ebx, 0x10
cmp dword [edi + 0x18], ebx
push esi
lea esi, [edi + 4]
jb 0x47d1d4
mov eax, dword [esi]
jmp 0x47d1d6
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x47d224
cmp dword [edi + 0x18], ebx
jb 0x47d1ea
mov ecx, dword [esi]
jmp 0x47d1ec
mov ecx, esi
and eax, 0xfffffffe
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
mov dword [0x53b824], 0x4e90c0
je 0x47d22a
cmp dword [edi + 0x18], ebx
mov dword [0x53b820], 4
jb 0x47d216
mov esi, dword [esi]
push esi
push 0x4e90f0
call fcn.0045eb40
add esp, 8
xor eax, eax
pop esi
pop ebx
pop ecx
ret
cmp dword [edi + 0x18], ebx
mov dword [0x53b820], 1
jb 0x47d23b
mov esi, dword [esi]
push esi
push 0x4e9114
call fcn.0045eb40
add esp, 8
pop esi
mov eax, 0x80004005
pop ebx
pop ecx
ret
Function at 0x4a0ad0
Capabilities:
Encode data using xor

Disassembly:
adc byte [bx + di - 8], ah
pop edx
push es
inc edi
dec edx
div dword [eax + 0x4a]
dec ecx
inc ebx
daa
cmp byte [0xd8e49494], al
cmp byte [esp + eax*8], ah
xchg edx, eax
int 0x20
pop ebp
retf 0x3bbd
adc ch, dh
adc al, 0xc
adc al, 0x1a
mov al, 0xa1
pop edi
and dword [0x1331690b], ebp
mov byte [eax], al
jns 0x4a0a77
inc eax
or dword [eax], 0x40d052f8
imul edx, dword [ecx - 0x1e], 0xf
cmpsb byte [esi], byte es:[edi]
push cs
pop ebx
aam 0xa1
xor byte [eax], dl
add al, byte [eax + 0x15b002be]
int 0x64
pop ds
invalid
shl byte [edi], 1
xor eax, 0x8a78466
dec edx
jg 0x4a0ad2
or byte [edx + 0x7f], cl
clc
adc byte [edx], bh
mov eax, 0x44b58147
cmpsd dword [esi], dword es:[edi]
adc byte [ebx + 0x764e7af4], 0xf3
mov word [esi], ss
inc ebp
pop eax
cmp dl, dl
mov bh, 0xf9
clc
jge 0x4a0ad6
sal byte [edi - 0x1f820707], cl
jl 0x4a0a98
mov cl, 0x67
adc edx, ebx
lea edx, [eax - 0x22]
fstp st(5)
psubb mm0, mm0
loope 0x4a0af0
add dword [esi - 0x6323fb7], 0xffffff97
mov bh, 0x4b
lds esp, [edi]
mov cl, 0x26
xchg edx, eax
ret

Function at 0x4baff0
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xe0d1ef2d
rol byte [edx + 0x50], cl
push eax
mul ebp
xor byte ds:[ebx - 0x1f], bh
movsb byte es:[edi], byte [esi]
mov es, word [ebx]
mov esi, 0x3ba12cb1
or eax, 0x52a0c2ac
jg 0x4baff7
ret 0x52a0
add ch, byte [edx - 0x7a]
mov edi, 0xa0c7fb42
push edi
mov bh, 0x19
cdq
jg 0x4bb008
into
test eax, 0xb7239de4
dec edx
jb 0x4baff7
invalid
Function at 0x427230
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x427258
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x427267
mov eax, 1
ret 4

Function at 0x427ee0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x433158]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4284f0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x428533
cmp eax, 0x40
je 0x428525
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x428578
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40ed69
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x40eae0
add ebx, 0x81638155
mov eax, ebx
call fcn.0040ed97
or eax, eax
xor dword [ecx], esi
inc ecx
mov ebx, ebx
inc eax
cmp ecx, edx
jne fcn.0040ed69
mov eax, 0x1dbd75fd
add eax, 0x8ab20bc0
ret
Function at 0x4018d0
Capabilities:
Check if file exists
Create directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42b458]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov edi, ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00413440
add esp, 0xc
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov word [ebp - 0x206], ax
lea eax, [ebp - 0x20c]
push str.IimeFile
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40195c
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 2
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00413440
add esp, 0xc
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHELL32.dll_PathYetAnotherMakeUniqueName]
push 3
lea eax, [ebp - 0x414]
xor esi, esi
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
call edi
test eax, eax
je 0x4019d5
push 2
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 4
push esi
lea eax, [ebp - 0x414]
push eax
call edi
test eax, eax
mov ecx, 1
cmovne esi, ecx
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00412426
mov esp, ebp
pop ebp
ret
Function at 0x402510
Capabilities:
Connect pipe
Create pipe
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x42b458]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x42d740]
push esi
push edi
cmp dword [ebx + 0x390], 0
je 0x402625
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.S:_ML__NWNR___LW_D:_A__GA___AU__D__GA___NU__A__GA___SY__A__GA___BA__A__GA___WD_
push ecx
xor edx, edx
mov dword [ebp - 8], 0
call fcn.00401330
add esp, 4
test al, al
je 0x40257e
push 0
lea eax, [ebp - 8]
mov edx, 2
push eax
push 1
push ecx
call fcn.00401330
add esp, 4
mov ecx, str.S:_ML__NWNR___LW_D:_A__GA___AU__D__GA___NU__A__GA___SY__A__GA___BA__A__GA___WD__A__GA___AC_
test al, al
cmove ecx, esi
push ecx
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x800
push 0x800
push 0xff
push 6
push 3
push str..pipeIimeNamedPipe
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4025c6
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0xffffffff
je 0x40263b
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4025ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x217
sete cl
test ecx, ecx
jne 0x4025ef
push esi
jmp 0x402611
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push esi
push 0x402790
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40263b
push eax
call edi
cmp dword [ebx + 0x390], 0
mov esi, str.S:_ML__NWNR___LW_D:_A__GA___AU__D__GA___NU__A__GA___SY__A__GA___BA__A__GA___WD_
jne 0x402541
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412426
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412426
mov esp, ebp
pop ebp
ret