joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404a60
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0051fce0
mov eax, dword [0x5ac1d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push 0xf0000000
push 1
push 0x57eb40
push 0
push 0x5b58c0
mov edi, ecx
call esi
test eax, eax
jne 0x404ad4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000f
jne 0x404ac1
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x5b58c0
call esi
test eax, eax
jne 0x404ad4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051b5fb
mov esp, ebp
pop ebp
ret
push 0x57eb3c
push edi
call fcn.0051c8e5
mov esi, eax
xor edi, edi
add esp, 8
cmp esi, edi
jne 0x404b02
mov eax, dword [0x5b58c0]
cmp eax, edi
je 0x404afb
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x404c2c
mov ecx, dword [0x5b58c0]
xor eax, eax
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x100c], eax
mov dword [ebp - 0x1008], eax
lea eax, [ebp - 0x1008]
push eax
push edi
push edi
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
call fcn.0051c8fc
add esp, 4
test eax, eax
jne 0x404b89
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0x1000
lea edx, [ebp - 0x1004]
push 1
push edx
call fcn.0051cb96
mov ecx, dword [ebp - 0x1008]
add esp, 0x10
push 0
push eax
lea eax, [ebp - 0x1004]
push eax
push ecx
call edi
push esi
call fcn.0051c8fc
add esp, 4
test eax, eax
je 0x404b50
xor edi, edi
mov ecx, dword [ebp - 0x1008]
push edi
lea edx, [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1018]
push eax
push 2
push ecx
mov dword [ebp - 0x1020], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 0x1008]
cmp eax, edi
je 0x404bc2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
mov dword [ebp - 0x1008], edi
call fcn.0051cc20
push 0x64
push edi
push ebx
call fcn.0051f6f0
add esp, 0x10
xor esi, esi
lea esp, [esp]
mov dl, byte [ebp + esi - 0x1018]
mov byte [ebp - 0x1019], dl
mov edx, 4
mov al, byte [ebp - 0x1019]
mov cl, dl
shr al, cl
and al, 0xf
cmp al, 0xa
jge 0x404c06
add al, 0x30
jmp 0x404c08
add al, 0x57
mov byte [ebx], al
inc ebx
sub edx, 4
jns 0x404bf2
inc esi
cmp esi, 0x10
jl 0x404be0
mov eax, dword [0x5b58c0]
cmp eax, edi
je 0x404c27
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov ecx, dword [ebp - 4]
mov dword [0x5b58c0], edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051b5fb
mov esp, ebp
pop ebp
ret
Function at 0x406a70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54eaa0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5ac1d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x14], esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x406abd
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov dword [esi], vtable.KM::SourceTemplate_class_KM::FileStore_.1.0
mov dword [esi + 4], vtable.KM::SourceTemplate_class_KM::FileStore_.0
mov dword [esi + 0x24], 0xffffffff
mov byte [esi + 0x28], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x18], vtable.KM::FileStore.0
mov dword [esi + 0x1c], vtable.KM::FileStore.1.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b5fb
mov esp, ebp
pop ebp
ret 4

Function at 0x4083a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ee88
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5ac1d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x57f228
mov esi, eax
push 0x81
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x30]
push str.KVIP
push eax
lea esi, [ebp - 0x2c]
call fcn.00406030
push 0x57ea4c
push ebx
call fcn.0051d6ec
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40846f
mov eax, dword [ebp - 0x2c]
mov edi, 0x10
cmp dword [ebp - 0x18], edi
jae 0x40843a
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push esi
push 1
push ecx
push eax
call fcn.0051d5b4
push esi
call fcn.0051cc20
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], edi
jb 0x408468
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041b1b8
add esp, 4
mov eax, 1
jmp 0x408494
push 0
call fcn.0051cc20
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x408492
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041b1b8
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051b5fb
mov esp, ebp
pop ebp
ret
Function at 0x4098b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call edx
mov edi, dword [esp + 0x2c]
mov ebp, eax
mov eax, dword [esp + 0x38]
mov ecx, eax
and cl, 3
movzx ecx, cl
neg ecx
sbb ecx, ecx
mov esi, dword [esp + 0x28]
not ecx
and ecx, ebp
mov edx, edi
neg edx
sbb edx, edx
and edx, ebp
mov dword [esp + 0x10], edx
mov edx, eax
and dl, 2
movzx edx, dl
neg edx
sbb edx, edx
not edx
and edx, ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
test al, 8
je 0x409944
mov eax, dword [esp + 0x34]
mov ebx, eax
sub ebx, ebp
add esi, ebx
mov ebx, eax
sub ebx, ebp
add edi, ebx
mov ebx, dword [esp + 0x30]
sub eax, ebp
add ebx, eax
mov eax, dword [esp + 0x10]
neg eax
neg ecx
neg edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jmp 0x409948
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
cmp ecx, ebp
jb 0x409a2b
mov ecx, eax
and ecx, 4
and eax, 1
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], eax
jmp 0x40996a
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4099e2
mov ecx, ebp
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x4099a2
mov edx, edi
mov edi, ebx
sub edx, esi
mov eax, esi
sub edi, esi
mov dword [esp + 0x28], ecx
mov ebx, dword [edx + eax]
xor ebx, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebx
jne 0x409987
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
add eax, eax
add eax, eax
mov ecx, ebp
sub ecx, eax
je 0x4099dc
lea edx, [eax + ebx]
mov dword [esp + 0x30], edx
lea edx, [eax + edi]
add eax, esi
test ecx, ecx
je 0x4099dc
mov edi, dword [esp + 0x30]
sub edx, eax
sub edi, eax
mov dword [esp + 0x30], ecx
mov cl, byte [edx + eax]
xor cl, byte [eax]
inc eax
dec dword [esp + 0x30]
mov byte [edi + eax - 1], cl
jne 0x4099c8
mov edi, dword [esp + 0x2c]
push ebx
push 0
push ebx
jmp 0x4099e5
push ebx
push edi
push esi
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [esp + 0x20], 0
je 0x4099fb
inc byte [esi + ebp - 1]
mov eax, dword [esp + 0x34]
add ebx, dword [esp + 0x1c]
add edi, dword [esp + 0x10]
add esi, dword [esp + 0x18]
sub eax, ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], eax
cmp eax, ebp
jae 0x409966
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x14
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x14
ret 0x14
Function at 0x40f9e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54cf57
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [ebp], 0x580e48
mov dword [ebp + 0x68], 0x580f08
mov dword [esp + 0x20], ebx
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov esi, dword [edx + 4]
add esi, ebp
mov dword [esp + 0x14], 1
call fcn.00410ee0
lea edi, [ebp + 0x10]
push esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], ebx
call fcn.00410c20
mov byte [esi + 0x40], al
cmp dword [esi + 0x38], ebx
jne 0x40fa71
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push ebx
mov ecx, esi
call fcn.00411ba0
mov dword [esp + 0x20], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
push edi
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00410af0
lea edx, [edi + 8]
mov dword [edi + 0x10], edx
lea ecx, [edi + 0x18]
mov dword [edi + 0x20], ecx
lea edx, [edi + 0x1c]
mov dword [edi + 0x24], edx
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [edi + 0x50], bl
mov byte [edi + 0x49], bl
lea eax, [edi + 0xc]
mov dword [edi + 0x14], eax
lea ecx, [edi + 0x28]
mov dword [edi + 0x30], ecx
lea edx, [edi + 0x2c]
mov dword [edi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [edi + 0x24]
mov dword [eax], ebx
mov ecx, dword [edi + 0x34]
mov dword [ecx], ebx
mov edx, dword [edi + 0x10]
mov dword [edx], ebx
mov eax, dword [edi + 0x20]
mov edx, dword [0x5b6a8c]
mov dword [eax], ebx
mov ecx, dword [edi + 0x30]
mov dword [ecx], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x44], ebx
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x40fc20
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x54ced8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x50]
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x40fc64
xor eax, eax
jmp 0x40fe16
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x40fc8d
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x40fc8d
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 1]
mov dword [edi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x40fe16
cmp dword [edi + 0x54], 0
je 0x40fe13
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x40fcb5
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x40fcdb
mov edi, dword [edi + 0x54]
movsx eax, bl
push edi
push eax
call fcn.0051d8b4
add esp, 8
cmp eax, 0xffffffff
je 0x40fe13
mov eax, ebx
jmp 0x40fe16
lea esi, [esp + 0x20]
mov byte [esp + 0x17], bl
call fcn.00410580
mov dword [esp + 0x48], 0
lea ebx, [edi + 0x4c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x34]
jmp 0x40fd00
mov edx, eax
cmp ebp, 0x10
jae 0x40fd0d
lea edx, [esp + 0x20]
mov eax, edx
add edx, dword [esp + 0x30]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x18]
push ebp
push edx
push eax
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x2b]
push edx
push ebx
call eax
test eax, eax
js 0x40fe02
cmp eax, 1
jg 0x40fdb1
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov ecx, eax
cmp ebp, 0x10
jae 0x40fd52
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x18]
sub esi, ecx
je 0x40fd83
cmp ebp, 0x10
jae 0x40fd63
lea eax, [esp + 0x20]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0051d5b4
add esp, 0x10
cmp esi, eax
jne 0x40fe02
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x17]
mov byte [edi + 0x49], 1
cmp dword [esp + 0x1c], edx
jne 0x40fdeb
test esi, esi
jne 0x40fd00
cmp dword [esp + 0x30], 0x20
jae 0x40fe02
push esi
push 8
lea esi, [esp + 0x28]
call fcn.0040b4f0
jmp 0x40fcf3
cmp eax, 3
jne 0x40fe02
mov edi, dword [edi + 0x54]
movsx eax, byte [esp + 0x17]
push edi
push eax
call fcn.0051d8b4
add esp, 8
cmp eax, 0xffffffff
je 0x40fdd3
mov esi, dword [esp + 0x50]
jmp 0x40fdd6
or esi, 0xffffffff
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
call fcn.004032e0
mov eax, esi
jmp 0x40fe16
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
call fcn.004032e0
mov eax, dword [esp + 0x50]
jmp 0x40fe16
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
call fcn.004032e0
or eax, 0xffffffff
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x38
ret 4
Function at 0x410850
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x54cea8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x41098f
cmp byte [edi + 0x49], 0
je 0x41098f
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x41097a
lea esi, [esp + 0x14]
call fcn.00410580
mov dword [esp + 0x3c], 0
lea ebx, [edi + 0x4c]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
mov edx, eax
cmp ebp, 0x10
jae 0x4108d2
lea edx, [esp + 0x14]
mov eax, edx
add edx, dword [esp + 0x24]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x10]
push ebp
push edx
push eax
mov eax, dword [esi + 0x18]
push ebx
call eax
sub eax, 0
je 0x410906
dec eax
je 0x41090a
sub eax, 2
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
jne 0x410975
jmp 0x41098a
mov byte [edi + 0x49], 0
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, eax
cmp ebp, 0x10
jae 0x41091d
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x10]
sub esi, ecx
je 0x41094a
cmp ebp, 0x10
jae 0x41092e
lea eax, [esp + 0x14]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0051d5b4
add esp, 0x10
cmp esi, eax
jne 0x410969
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp byte [edi + 0x49], 0
je 0x41097e
test esi, esi
jne 0x4108c5
push esi
push 8
lea esi, [esp + 0x1c]
call fcn.0040b4f0
jmp 0x4108bd
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004032e0
xor al, al
jmp 0x410991
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.004032e0
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x30
ret
Function at 0x410af0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x54cb2b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0053ec19
push 4
mov dword [esp + 0x20], 0
call fcn.0041b189
mov edi, eax
add esp, 4
test edi, edi
je 0x410b6e
call fcn.0053ef29
mov dword [edi], eax
call fcn.0053ece8
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0053eaea
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x410b63
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0053eb12
jmp 0x410b70
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x412b90
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x54e130
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp], eax
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
mov dword [eax + 0xa8], 0x10
mov byte [eax + 0xa1], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [eax], vtable.KM::SHA1.0
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x10
ret 4

Function at 0x412cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54e4a0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x58]
lea ebp, [esi + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], ebp
cmp ebp, 0xffffffff
jbe 0x412d1f
call fcn.004072c0
test ebp, ebp
jne 0x412d27
xor ebx, ebx
jmp 0x412d34
mov edi, ebp
call fcn.00414a50
mov edi, dword [esp + 0x20]
mov ebx, eax
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x1c]
push esi
push eax
push ebx
mov dword [esp + 0x54], 0
call fcn.0051f970
mov ecx, dword [edi]
mov dword [esi + ebx], ecx
mov edx, dword [edi + 4]
mov edi, 0x18
mov dword [esi + ebx + 4], edx
mov dword [esp + 0x40], edi
call fcn.00414a50
mov esi, eax
mov dword [esp + 0x44], esi
push 0xc8
push edi
push ebp
push ebx
mov ecx, esi
mov byte [esp + 0x64], 3
call fcn.00412820
mov ecx, dword [esi]
mov eax, dword [esp + 0x30]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [esi + 0x10]
mov eax, dword [esp + 0x34]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
mov dword [eax + 4], edx
xor al, al
mov edi, esi
mov ecx, 0x18
push esi
rep stosb byte es:[edi], al
call fcn.0051c1b1
xor al, al
mov edi, ebx
mov ecx, ebp
push ebx
rep stosb byte es:[edi], al
call fcn.0051c1b1
add esp, 0x24
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x38
ret
Function at 0x414950
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, eax
mov eax, ebp
shr eax, 2
xor ecx, ecx
xor edx, edx
test eax, eax
je 0x41498a
mov edx, edi
sub esi, edi
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esi + edx]
xor ebx, dword [edx]
add edx, 4
or ecx, ebx
dec eax
jne 0x414974
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
pop ebx
lea eax, [edx*4]
sub ebp, eax
jne 0x4149a1
pop edi
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebp
pop ecx
ret
add esi, eax
add edi, eax
mov eax, ecx
mov edx, ecx
shr edx, 0x10
shr eax, 0x18
or al, dl
mov edx, ecx
shr edx, 8
or al, dl
or cl, al
test ebp, ebp
je 0x4149cf
mov eax, edi
sub esi, edi
mov edi, ebp
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x4149c4
pop edi
xor eax, eax
test cl, cl
pop esi
sete al
pop ebp
pop ecx
ret

Function at 0x4151d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54e760
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x5af0e8
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.KM::ArraySink.0
mov dword [esp + 0x30], vtable.KM::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0051b5fb
mov esp, ebp
pop ebp
ret 8
Function at 0x415e20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x54e3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5ac1d0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x5ac1d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea esi, [edi + 0x10]
mov ecx, 0x100
mov dword [esp + 0x20], edi
mov dword [edi + 0xc], 0xffffffff
mov dword [edi], vtable.KM::MessageQueue.0
mov dword [edi + 4], vtable.KM::MessageQueue.1.0
call fcn.00414b70
mov dword [esp + 0x48], 2
xor ebx, ebx
lea esi, [edi + 0x38]
push 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], ebx
call fcn.0041b189
add esp, 4
cmp eax, ebx
je 0x415f60
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x50], 3
call fcn.004163d0
mov byte [esp + 0x48], 4
lea esi, [edi + 0x50]
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esi], ebx
call fcn.0041b189
add esp, 4
cmp eax, ebx
je 0x415f37
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x50], 5
call fcn.00416760
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0051b5fb
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], ebx
call fcn.0051bc3f
push 0x5a039c
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.0051fdd8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.0051bc3f
push 0x5a039c
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], vtable.std::bad_alloc.0
call fcn.0051fdd8
int3