joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423538]
jne 0x40422a
repz ret
jmp fcn.00407b40

Function at 0x407863
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c87
and dword [ebp - 4], 0
cmp dword [0x425b64], 0
mov ebx, eax
jne 0x407914
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4079c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4079c5
push eax
call fcn.00404c15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425b64], eax
call esi
push eax
call fcn.00404c15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425b68], eax
call esi
push eax
call fcn.00404c15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425b6c], eax
call esi
push eax
call fcn.00404c15
pop ecx
mov dword [0x425b74], eax
test eax, eax
je 0x407914
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c15
pop ecx
mov dword [0x425b70], eax
mov eax, dword [0x425b70]
cmp eax, ebx
je 0x40796c
cmp dword [0x425b74], ebx
je 0x40796c
push eax
call fcn.00404c90
push dword [0x425b74]
mov esi, eax
call fcn.00404c90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40796c
test edi, edi
je 0x40796c
call esi
test eax, eax
je 0x407963
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407963
test byte [ebp - 0xc], 1
jne 0x40796c
or dword [ebp + 0x10], 0x200000
jmp 0x4079a5
mov eax, dword [0x425b68]
cmp eax, ebx
je 0x4079a5
push eax
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4079a5
mov eax, dword [0x425b6c]
cmp eax, ebx
je 0x4079a5
push eax
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425b64]
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4079c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408950
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
push 0xf7f7ae1c
pop ebx
call fcn.00408970
and ebx, edi
xor dword [eax], ecx
inc eax
push ebx
pop edi
cmp eax, edx
jne fcn.00408950
sub ebx, edi
ret
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xb974c0ba
mov edx, 0xeac9d4c0
xor dword [ebx + ebx - 0x66], 0x79b935a0
sal byte [ecx + edi*4 - 0x46], 0xc0
and dword [eax], esi
pop edi
dec ebx
xor dword [ecx + 0x32788531], esi
out dx, eax
sal ah, 1
test byte [edx - 0x6f], bh
sal byte [ecx + edi*4 - 0x46], 0xc0
aam 0xc9
ljmp 0x35a0
xchg ecx, eax
xor eax, 0x33b5bab9
cmp al, byte [edx - 0x3f]
push es
sti
cmp dword [eax], ebp
jne 0x414a4b
mov dh, 0x43
pushfd
mov eax, 0x51f7d3ce
mov ebx, 0x8b526bb4
sub ah, dl
in al, 0x45
aas
pushfd
jb 0x414a6f
aas
mov edx, dword [edx - 0x61]
sub byte [eax - 0x25], dh
inc ebp
aas
int3
and dword [eax], esi
pop edi
push es
jno 0x414b2f
jmp 0x414a49
in al, 0x98
adc eax, edi
sar byte [ebp + 0x42], 0xf5
test al, 0x74
leave
sti
sar byte [edx], 0xfe
add bl, byte [eax]
test byte [ebx - 0x174484c4], 0xda
test dword [ebp + 0x46], ebx
cld
jns 0x414bc1
test eax, 0x7ef5c0fa
mov ebx, 0x3bb974c0
popfd
iretd
sahf
inc ebx
mov al, 0xbd
cmp eax, dword [edi]
hlt
jp 0x414b7e
sal byte [ecx + edi*4 + 0x79], 0x41
mov bl, 0xa7
and dword [eax - 0x7d], eax
pop es
int3
Function at 0x91b58c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x91b592
pop ebp
sub ebp, 6
sub ebp, 0x51b58c
jmp 0x91b5f0
adc byte [si], bh
idiv dword [edx + 0x4a]
cmp eax, 0xe733489e
into
and byte [ebx - 0x45c73232], ch
jb 0x91b5ce
add byte [eax], al
add byte [edx + 0x6b], dh
add byte [eax], al
jb 0x91b63d
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
mov edx, 0xb8082750
invalid
jmp 0x91b5f9
mov eax, 0x51b58c
add eax, ebp
add eax, 0x93
mov ecx, 0x61c
mov edx, 0xae439e48
xor byte [eax], dl
inc eax
dec ecx
jne 0x91b610
jmp 0x91b623
and cl, byte [eax]
and byte [eax + 0x58], cl
dec eax
dec eax
and byte [eax - 0x7c], cl
dec eax
jnp 0x91b5b9
sbb byte [edi + 0xfa974dd], dh
dec eax
sbb bl, al
test ebx, eax
sal dword [eax + ecx*2 + 0x48], 0x48
je 0x91b687
dec eax
dec eax
leave
mov dword [eax + 0x4b484848], esi
test eax, esi
dec esi
dec eax
dec eax
dec eax
pushal
dec eax
dec eax
dec eax
mov edi, 0xc3804baa
leave
inc esp
dec eax
dec eax
dec eax
dec ebx
lea ebx, [eax]
and byte [ebp + 0x2048417e], al
cmc
add byte ss:[eax + 0x49], cl
insb byte es:[edi], dx
and byte [eax + 0x48], cl
dec eax
dec eax
mov al, byte [0x4848484d]
mov eax, dword [0x48484862]
sbb eax, 0x486c24c5
ret
ret
Function at 0x461f58
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x462037
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x462005
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ea8
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 8]
call fcn.00407ca8
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.00409330
push dword [ebp - 0x18]
push 0x462050
lea ecx, [ebp - 0x1c]
movzx eax, word [ebp - 8]
mov edx, 4
call fcn.00409330
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405228
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404efc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46201c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46203e
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404ecc
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]

Function at 0x40124c
Capabilities:
Terminate process

Disassembly:
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
xor edi, edi
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x10], 0
cmp dword [0x4267a4], edi
je 0x4013c4
invalid
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x1c], 0x12
cmp dword [ebp - 0x18], 0
je 0x401544
nop
nop
nop
sub dword [esp + 4], 0x10
jmp 0x400401
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.004016e1
add esp, 8
mov edi, eax
cmp edi, dword [ebp - 0x18]
jle 0x40157e
lea eax, [ebp - 0xa0]
push eax
mov eax, dword [0x406190]
add eax, dword [ebp - 0x18]
push eax
push 0x406194
call fcn.0040221c
add esp, 0xc
xor eax, eax
pop edi
leave
ret
Function at 0x4025dd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x40263c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402634
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402634
mov eax, dword [ebp - 4]
jmp 0x402650
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402611
mov eax, 0
leave
ret

Function at 0x402aa0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push edi
mov ecx, 0x11
push ebx
sub esp, 0xa4
mov eax, dword [0x407040]
mov dword [esp + 0x9c], eax
xor eax, eax
lea edx, [esp + 0x58]
lea ebx, [esp + 0x48]
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, 4
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x4050a4
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
cmp dword [esp + 0x48], 0
jne 0x402b2e
xor ebx, ebx
jmp 0x402bd4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp], str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
call sub.PSAPI.DLL_GetModuleInformation
sub esp, 0x10
mov ebx, dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
lea eax, [esp + 0x38]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
sub esp, 0x14
test eax, eax
je 0x402b27
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
mov eax, dword [esp + 0x9c]
sub eax, dword [0x407040]
je 0x402be8
call fcn.00401770
add esp, 0xa4
mov eax, ebx
pop ebx
pop edi
ret
Function at 0x402bf4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp], str.NTDLL.DLL
mov esi, dword [esp + 0x40]
call sub.KERNEL32.dll_GetModuleHandleW
push edx
mov dword [esp + 4], str.NtAllocateVirtualMemory
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
push ecx
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x28]
mov dword [esp + 0x24], 0
mov dword [esp + 0xc], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], 0x3000
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0xffffffff
call eax
sub esp, 0x18
test eax, eax
jne 0x402c7d
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x44]
rep movsb byte es:[edi], byte [esi]
call dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
sub eax, dword [0x407040]
je 0x402c8e
call fcn.00401770
add esp, 0x34
pop esi
pop edi
ret

Function at 0x402d04
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
mov ecx, 8
push esi
mov esi, 0x405044
push ebx
sub esp, 0x250
mov eax, dword [0x407040]
mov dword [esp + 0x24c], eax
xor eax, eax
lea edi, [esp + 0x2c]
mov ebx, dword [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov byte [esp + eax + 0x14c], al
and edx, 0x1f
mov dl, byte [esp + edx + 0x2c]
mov byte [esp + eax + 0x4c], dl
inc eax
cmp eax, 0x100
jne 0x402d32
xor esi, esi
xor edi, edi
movzx eax, byte [esp + esi + 0x14c]
add eax, edi
add al, byte [esp + esi + 0x4c]
movzx edi, al
lea eax, [esp + 0x14c]
add eax, esi
inc esi
mov dword [esp + 4], eax
lea eax, [esp + 0x14c]
add eax, edi
mov dword [esp], eax
call fcn.00402c94
cmp esi, 0x100
jne 0x402d52
mov edi, dword [esp + 0x264]
xor esi, esi
xor eax, eax
add edi, ebx
cmp edi, ebx
je 0x402de9
lea edx, [esi + 1]
lea ecx, [esp + 0x14c]
movzx esi, dl
add al, byte [esp + esi + 0x14c]
movzx eax, al
lea edx, [ecx + eax]
mov dword [esp + 0x1c], eax
mov dword [esp + 4], edx
lea edx, [ecx + esi]
mov dword [esp], edx
call fcn.00402c94
mov eax, dword [esp + 0x1c]
mov dl, byte [esp + eax + 0x14c]
add dl, byte [esp + esi + 0x14c]
movzx edx, dl
mov dl, byte [esp + edx + 0x14c]
xor byte [ebx], dl
inc ebx
jmp 0x402d97
mov eax, dword [esp + 0x24c]
sub eax, dword [0x407040]
je 0x402dfd
call fcn.00401770
mov eax, dword [esp + 0x264]
add esp, 0x250
pop ebx
pop esi
pop edi
ret
Function at 0x402e10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15c]
mov esi, 0x405064
push ebx
sub esp, 0x17c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x11c], 0
mov eax, dword [0x407040]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov eax, 0x10
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x118]
mov eax, ecx
mov ecx, 0x3f
rep stosd dword es:[edi], eax
movzx edx, byte [ebp + eax - 0x15c]
mov byte [ebp + edx - 0x11c], al
inc eax
cmp eax, 0x40
jne 0x402e56
xor edx, edx
test byte [ebp + 0xc], 3
jne 0x402fee
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
shr edx, 2
cmp byte [ebx + eax - 1], 0x3d
lea edx, [edx + edx*2]
jne 0x402e8b
dec edx
mov eax, dword [ebp + 0xc]
cmp byte [ebx + eax - 2], 0x3d
jne 0x402e96
dec edx
lea eax, [edx + 0xf]
shr eax, 4
shl eax, 4
call fcn.00402954
mov ecx, 0
mov dword [ebp - 0x170], 0
sub esp, eax
test edx, edx
cmovns ecx, edx
mov edi, esp
xor eax, eax
mov dword [ebp - 0x174], esp
xor esi, esi
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp + 0xc]
jb 0x402ee4
mov esi, dword [ebp - 0x174]
mov edi, ebx
mov ecx, edx
rep movsb byte es:[edi], byte [esi]
jmp 0x402fee
mov eax, dword [ebp - 0x170]
xor edi, edi
movzx eax, byte [ebx + eax]
cmp al, 0x3d
je 0x402efc
movzx edi, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 1]
cmp al, 0x3d
je 0x402f23
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x170]
movzx eax, byte [ebx + eax + 2]
cmp al, 0x3d
je 0x402f4a
movzx eax, byte [ebp + eax - 0x11c]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x170]
xor ecx, ecx
add dword [ebp - 0x170], 4
movzx eax, byte [ebx + eax + 3]
cmp al, 0x3d
je 0x402f6c
movzx eax, byte [ebp + eax - 0x11c]
mov ecx, eax
mov dword [ebp - 0x16c], esi
cmp edx, esi
ja 0x402f81
mov esi, dword [ebp - 0x16c]
jmp 0x402ec8
mov eax, dword [ebp - 0x178]
shl edi, 0x12
inc dword [ebp - 0x16c]
shl eax, 0xc
add eax, edi
mov edi, dword [ebp - 0x17c]
shl edi, 6
add eax, edi
mov edi, dword [ebp - 0x174]
add eax, ecx
mov ecx, eax
shr eax, 0x10
mov byte [edi + esi], al
cmp edx, dword [ebp - 0x16c]
jbe 0x402f76
lea eax, [esi + 2]
mov dword [ebp - 0x178], eax
mov eax, edi
mov edi, dword [ebp - 0x16c]
mov byte [eax + edi], ch
lea eax, [esi + 2]
mov dword [ebp - 0x16c], eax
cmp edx, eax
jbe 0x402f76
lea eax, [esi + 3]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x174]
mov byte [eax + esi + 2], cl
jmp 0x402f76
mov eax, dword [ebp - 0x1c]
sub eax, dword [0x407040]
je 0x402ffe
call fcn.00401770
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403008
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x407040]
mov dword [esp + 0x2c], eax
xor eax, eax
call fcn.00402aa0
mov dword [esp], str.ntdll.dll
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x3c]
mov dword [esp + 0x28], 0
add eax, ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
movzx eax, word [eax + 6]
cmp eax, dword [esp + 0x14]
jle 0x403102
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + 0x14]
mov dword [esp + 4], str..text
lea ebx, [ecx + eax + 0x18]
imul eax, dword [esp + 0x14], 0x28
add ebx, eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40308f
inc dword [esp + 0x14]
jmp 0x40304c
lea edx, [esp + 0x28]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], edx
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
add eax, dword [ebx + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x1c], eax
call eax
sub esp, 0x10
test eax, eax
je 0x403102
mov esi, dword [ebx + 0xc]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
mov ecx, dword [ebx + 8]
add eax, esi
add esi, ebp
mov edi, eax
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x18]
add eax, dword [ebx + 0xc]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call eax
sub esp, 0x10
test eax, eax
jne 0x403089
mov eax, dword [esp + 0x2c]
sub eax, dword [0x407040]
je 0x403113
call fcn.00401770
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40893f
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
and eax, eax
and eax, eax
call fcn.00408961
xor dword [ebx], edx
inc ebx
mov ecx, ecx
add eax, ecx
cmp ebx, edi
jne fcn.0040893f
sub ecx, eax
ret
Function at 0x402490
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d43e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4845c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 4
call fcn.00435eca
mov edx, eax
add esp, 4
test edx, edx
je 0x4024de
mov ecx, dword [ebp + 8]
mov dword [edx], ecx
jmp 0x4024e0
xor edx, edx
mov dword [ebp + 8], edx
mov byte [ebp - 4], 1
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 2
mov eax, 1
mov dword [ebp - 0x10], eax
and eax, 0xfffffffe
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
lea edi, [esi + 4]
push edi
push 0
push edx
push 0x403ce0
push 0
push 0
call fcn.0043fc8c
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x40255d
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.0041d52e
int3
Function at 0x404470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x40448b
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4044b4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4044a0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00403960
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4044d4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x405810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45db7d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4845c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00435eca
mov esi, eax
add esp, 4
test esi, esi
je 0x405862
push 1
call fcn.0041d786
add esp, 4
mov dword [esi + 4], eax
jmp 0x405864
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea edx, [eax + 0x18]
lea ecx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [edx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx], 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x20], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [ecx], 0
mov dword [edx + 0x4c], 0
mov eax, dword [0x486378]
mov ecx, dword [0x48637c]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063c0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi], 0x61707865
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx edx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi]
shl edx, 8
or edx, eax
mov dword [edi + 0x10], edx
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], ecx
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x18], ecx
movzx ecx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x1c], ecx
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x20], ecx
movzx ecx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x18]
mov edx, dword [ebp + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x28], ecx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x34], 0
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x38], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov eax, edi
mov dword [edi + 0x3c], ecx
pop edi
pop esi
pop ebp
ret 8