joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.004ef2f0
mov eax, dword [0x572bb0]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.0041bec0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x439083
xor eax, eax
jmp 0x43920d
lea ecx, [esp + 0x2c]
push ecx
call fcn.0044aae0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x4390a8
mov dword [esp + 0x148], edi
jmp 0x4390d2
cmp dword [esp + 0x148], 0xffffffff
jne 0x4390d2
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x4390c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4390c0
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x4391fb
jmp 0x4390e8
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x4390ee
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.0044a820
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0044aa20
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0044aa20
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0044aa30
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.004eebf0
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x4391e6
dec eax
mov dword [esp + 0x10], eax
jmp 0x439190
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.0044abf0
add esp, 0x1c
test esi, esi
jle 0x4391df
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x4391d0
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x439190
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4390e0
lea eax, [esp + 0x2c]
push eax
call fcn.0044ab80
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e94b7
add esp, 0x130
ret
Function at 0x44a820
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.004ef2f0
mov eax, dword [0x572bb0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x44a86f
mov eax, 1
mov dword [esi], ebp
jmp 0x44a871
mov ebp, dword [esi]
test ecx, ecx
je 0x44a954
push ebp
call fcn.0041beb0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x44a8a0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.00406830
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x44a8f7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.00424ea0
add esp, 0xc
test eax, eax
je 0x44a9f6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.00425050
add esp, 0xc
test eax, eax
je 0x44a9f6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.00425060
add esp, 0xc
test eax, eax
je 0x44a9f6
jmp 0x44a931
cmp edi, 0x80
jbe 0x44a913
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.00406830
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.004eebf0
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x44a95c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.004ef3a0
add esp, 0xc
jmp 0x44a95c
test eax, eax
je 0x44a9e2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x44a960
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.00424ea0
add esp, 0xc
test eax, eax
je 0x44a9f6
push ebp
call fcn.0041beb0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00425050
add esp, 0x10
test eax, eax
je 0x44a9f6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x44a9a4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.00424ea0
add esp, 0xc
test eax, eax
je 0x44a9f6
push ebp
call fcn.0041beb0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.00425050
add esp, 0x10
test eax, eax
je 0x44a9f6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.004251c0
add esp, 8
test eax, eax
jne 0x44a9fa
xor eax, eax
jmp 0x44a9ff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e94b7
add esp, 0x8c
ret
Function at 0x44d6a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.004ef2f0
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.0041bec0
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x44d8e1
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x44d767
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.00405ac0
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.004012b0
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x44d719
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x44d79b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x44d7d9
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.00405460
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x44d7c7
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.004030a0
add esp, 0x14
jmp 0x44d8c4
cmp esi, 0xfffffffe
jne 0x44d771
jmp 0x44d6dd
jge 0x44d6dd
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.004030a0
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x44d725
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.004030a0
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.00408790
add esp, 8
test eax, eax
jle 0x44d8c0
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.00424e50
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00424ea0
push 8
lea eax, [esp + 0x34]
push 0x542130
push eax
call fcn.00425050
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00425050
add esp, 0x28
test esi, esi
je 0x44d834
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00425050
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00425190
lea ecx, [esp + 0x2c]
push ecx
call fcn.004250e0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.00410fe0
add esp, 0x24
test eax, eax
jne 0x44d8c0
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x44d896
xor ecx, ecx
test esi, esi
jle 0x44d896
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x44d887
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44d8af
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x44d7bb
push ebp
call fcn.00405600
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x4550e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a93e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 2
lea ecx, [edi + 0x3c]
push dword [edi + 0x44]
mov dword [edi + 0x3c], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x48]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 1
push dword [edi + 0x30]
mov dword [edi + 0x28], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x34]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x14]
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 0
push dword [edi + 0x1c]
mov dword [edi + 0x14], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x20]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov ecx, edi
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0xffffffff
push dword [edi + 8]
mov dword [edi], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0xc]
call fcn.004e98a6
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x458ee0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ae44
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x118]
mov dword [ebp - 4], 9
push dword [esi + 8]
mov ecx, esi
mov dword [esi], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [esi + 0xc]
call fcn.004e98a6
add esp, 4
mov dword [esi + 4], 0
lea ecx, [edi + 0xf0]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 8
call fcn.004590e0
lea ecx, [edi + 0xc8]
mov byte [ebp - 4], 7
call fcn.004590e0
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 6
call fcn.004590e0
lea ecx, [edi + 0x78]
mov byte [ebp - 4], 5
call fcn.004590e0
lea ecx, [edi + 0x64]
mov byte [ebp - 4], 4
call fcn.0045acd0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x50]
push dword [edi + 0x58]
mov dword [edi + 0x50], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x5c]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x54], 0
lea ecx, [edi + 0x3c]
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov byte [ebp - 4], 2
call fcn.0045ab90
mov byte [ebp - 4], 1
lea ecx, [edi + 0x28]
push dword [edi + 0x30]
mov dword [edi + 0x28], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x34]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
lea ecx, [edi + 0x14]
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 0
push dword [edi + 0x1c]
mov dword [edi + 0x14], vtable.CBaseRecordVector.0
push 0
call dword [0x54a9f0]
push dword [edi + 0x20]
call fcn.004e98a6
add esp, 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 0xffffffff
push dword [edi + 8]
mov dword [edi], vtable.CBaseRecordVector.0
push 0
mov ecx, edi
call dword [0x54a9f0]
push dword [edi + 0xc]
call fcn.004e98a6
add esp, 4
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45a5f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b070
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebp - 0x48]
mov dword [ecx + 0x1e0], eax
lea ebx, [ebx]
cmp esi, dword [ebp + 0x14]
jge 0x45a790
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push dword [eax + esi*4]
call fcn.004540a0
mov byte [ebp - 4], 1
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_CharUpperW]
cmp dword [ebp - 0x1c], 0
jne 0x45a68e
push dword [ebp - 0x20]
call fcn.004e98a6
add esp, 4
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, esi
lea edx, [ebp - 0x14]
shl edi, 4
lea ecx, [ebp - 0x20]
add edi, dword [ebp + 0x10]
call fcn.00461980
test eax, eax
jne 0x45a75c
push 2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0045a990
mov edx, 0x54ade8
mov ecx, dword [eax]
call fcn.0046c400
push dword [ebp - 0x2c]
test eax, eax
sete bl
call fcn.004e98a6
add esp, 4
test bl, bl
je 0x45a738
push 2
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x20]
call fcn.0045a960
mov ecx, dword [ebp + 8]
mov edx, edi
add ecx, 0x1e0
mov byte [ebp - 4], 2
push ecx
push dword [ebp - 0x48]
mov ecx, eax
call fcn.004619d0
add esp, 8
mov byte [ebp - 4], 1
mov edi, eax
push dword [ebp - 0x38]
call fcn.004e98a6
add esp, 4
test edi, edi
je 0x45a75c
push dword [ebp - 0x20]
call fcn.004e98a6
mov eax, edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x20]
call fcn.004e98a6
mov eax, 0x80070057
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov byte [ebp - 4], 0
push dword [ebp - 0x20]
call fcn.004e98a6
add esp, 4
inc esi
jmp 0x45a640
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x461e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, 0x400000
cmp eax, ecx
mov dword [ebp + 0x10], 0
push 0
cmova eax, ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
setne dl
test ecx, ecx
je 0x461e9e
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
test dl, dl
je 0x461ea8
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x461ebb
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x461ec5
movzx eax, ax
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x461ff0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46203d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46203d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46202c
mov eax, 0x80004005
pop edi
mov esp, ebp
pop ebp
ret 8
jle 0x462051
movzx eax, ax
or eax, 0x80070000
pop edi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, edi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8

Function at 0x4620a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, 0x400000
push esi
mov esi, dword [ebp + 8]
cmp eax, ecx
push 0
cmova eax, ecx
mov dword [ebp + 0x10], 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp + 0x10]
setne dl
add dword [esi + 0x10], eax
adc dword [esi + 0x14], 0
pop esi
test ecx, ecx
je 0x4620e7
mov dword [ecx], eax
test dl, dl
je 0x4620f1
xor eax, eax
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x462104
mov eax, 0x80004005
pop ebp
ret 0x10
jle 0x46210e
movzx eax, ax
or eax, 0x80070000
pop ebp
ret 0x10

Function at 0x4622b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4622c1
mov dword [esi], 0
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x46231b
mov eax, 0x8000
cmp ecx, eax
push 0
cmovb eax, ecx
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x4622f4
mov ecx, dword [ebp + 0x14]
add dword [esi], ecx
test eax, eax
jne 0x46231b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x46230c
mov eax, 0x80004005
pop esi
pop ebp
ret 0x10
jle 0x46231d
movzx eax, ax
or eax, 0x80070000
pop esi
pop ebp
ret 0x10
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x463730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 0xc]
push 0x463780
push 0
push 0
call fcn.004ea558
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x463760
xor eax, eax
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x464550
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x572bb0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov eax, dword [esi]
cmp eax, 0x3f
jne 0x4645e9
cmp dword [esi + 4], edx
jbe 0x46458e
lea ecx, [ecx]
mov al, byte [esi + edx + 8]
mov byte [esi + edx + 0x24], al
inc edx
cmp edx, dword [esi + 4]
jb 0x464580
xor ecx, ecx
cmp dword [esi + 0x1c], ecx
jbe 0x4645af
cmp edx, 0x20
jae 0x4646f5
mov eax, dword [esi + 0x20]
mov al, byte [ecx + eax]
inc ecx
mov byte [esi + edx + 0x24], al
inc edx
cmp ecx, dword [esi + 0x1c]
jb 0x464595
cmp edx, 0x20
jae 0x4646f5
mov ecx, 0x20
lea edi, [esi + 0x24]
sub ecx, edx
add edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.004e94b7
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [esp + 0x20], 0x6a09e667
bts ecx, eax
mov dword [esp + 0x24], 0xbb67ae85
cmp eax, 0x20
mov dword [esp + 0x28], 0x3c6ef372
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0xa54ff53a
cmovae edx, ecx
mov dword [esp + 0x30], 0x510e527f
xor ecx, edx
mov dword [esp + 0x34], 0x9b05688c
cmp eax, 0x40
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
cmovae edx, ecx
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
movlpd qword [esp + 0x18], xmm0
test edx, edx
jb 0x4646e9
ja 0x464673
test ecx, ecx
je 0x4646e9
mov ebx, dword [esp + 0x1c]
lea eax, [esi + 8]
mov edi, dword [esp + 0x18]
mov edi, edi
push dword [esi + 4]
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.00470fa0
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x24]
add esp, 4
push dword [esi + 0x1c]
call fcn.00470fa0
add esp, 4
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x20]
push 8
call fcn.00470fa0
add esp, 4
xor eax, eax
lea ebx, [ebx]
inc byte [esp + eax + 0x8c]
jne 0x4646cf
inc eax
cmp eax, 8
jl 0x4646c0
add edi, 1
lea eax, [esi + 8]
adc ebx, 0
cmp ebx, dword [esp + 0x14]
jb 0x464680
ja 0x4646e9
lea eax, [esi + 8]
cmp edi, dword [esp + 0x10]
jb 0x464680
lea edx, [esi + 0x24]
lea ecx, [esp + 0x20]
call fcn.00471040
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e94b7
mov esp, ebp
pop ebp
ret
Function at 0x465800
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [ecx + 0x24]
cmp edi, esi
je 0x46584b
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 4], 0
mov word [eax], cx
mov eax, dword [edi + 4]
inc eax
cmp eax, dword [esi + 8]
je 0x46582f
push eax
mov ecx, esi
call fcn.00454e00
mov ecx, dword [edi]
mov edx, dword [esi]
movzx eax, word [ecx]
lea edx, [edx + 2]
mov word [edx - 2], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x465833
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ebx, dword [ebp + 8]
xor edi, edi
cmp dword [ebx + 8], edi
jle 0x46587f
test edi, edi
jle 0x465862
push 0x5c
mov ecx, esi
call fcn.0045a840
mov eax, dword [ebx + 0xc]
mov ecx, esi
push dword [eax + edi*4]
call fcn.0045a8c0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc edi
cmp edi, dword [ebx + 8]
jl 0x465855
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x466470
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bac0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x572bb0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp dword [ebp + 0xc], 3
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
ja 0x46663b
cmp dword [esi + 0xa0], 0
je 0x4664fa
mov ecx, dword [esi + 0x9c]
mov eax, dword [ecx + 0x18]
not eax
add dword [esi + 0xf0], eax
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], ecx
mov byte [esi + 0x90], 1
mov ecx, dword [esi + 0xa0]
test ecx, ecx
je 0x4664fa
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xa0], 0
cmp dword [esi + 0x98], 0
je 0x4665a6
cmp byte [esi + 0x5c], 0
je 0x466518
cmp byte [esi + 0x7e], 0
je 0x466518
lea ecx, [esi + 0x70]
jmp 0x466528
mov eax, dword [esi + 0x10]
cmp byte [eax + 0x2c], 0
je 0x466526
lea ecx, [eax + 0x24]
jmp 0x466528
xor ecx, ecx
cmp byte [esi + 0x5b], 0
je 0x466539
cmp byte [esi + 0x7d], 0
je 0x466539
lea edi, [esi + 0x68]
jmp 0x46653b
xor edi, edi
cmp byte [esi + 0x5a], 0
je 0x46654c
cmp byte [esi + 0x7c], 0
je 0x46654c
lea edx, [esi + 0x60]
jmp 0x46654e
xor edx, edx
mov eax, dword [esi + 0x94]
push ecx
push edi
push edx
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ecx, dword [esi + 0x94]
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x88], eax
mov eax, dword [ecx + 0x14]
mov dword [esi + 0x8c], eax
mov byte [esi + 0x90], 1
call fcn.00462060
test eax, eax
jne 0x46665a
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x4665a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x98], 0
cmp byte [esi + 0x90], 0
jne 0x4665bf
mov ecx, esi
call fcn.00465940
cmp byte [esi + 0x90], 0
je 0x4665d7
mov eax, dword [esi + 0x88]
add dword [esi + 0xe8], eax
mov eax, dword [esi + 0x8c]
adc dword [esi + 0xec], eax
cmp byte [esi + 0x80], 0
je 0x4665f0
add dword [esi + 0xd8], 1
adc dword [esi + 0xdc], 0
jmp 0x4665fe
add dword [esi + 0xe0], 1
adc dword [esi + 0xe4], 0
cmp byte [esi + 0x59], 0
je 0x466616
cmp byte [esi + 0x7f], 0
je 0x466616
push dword [esi + 0x78]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esi + 0x18]
movzx eax, byte [esi + 0x5d]
push eax
push dword [ebp + 0xc]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x98]
test ecx, ecx
je 0x466655
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x98], 0
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8