joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
call fcn.004a4b80
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x49c850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49c7f4
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x140], 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004975a0
push str.Failed_to_start_thread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x14]
call edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x28]
call eax
xor al, al
jmp 0x49c847
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004975a0
push str.Task_started_in_background_thread.
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 4]
push ecx
push str.createThread
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004a5930
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x18]
mov edx, dword [eax + 0x28]
call edx
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x4a46b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ba22
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x734fd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ClsBgTask.0
mov ecx, dword [ebp - 0x10]
mov byte [ecx + 8], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 9], 1
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xa], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004a8f90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x10]
mov byte [edx + 0x28], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00488770
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.00473e50
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xd8], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xe0
call fcn.004a4da0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.004f2df0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a47d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63ba80
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x734fd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.ClsBgTask.0
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004a95a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.004f2eb0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0xe0
call fcn.004a4e70
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.00475780
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00488880
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004a8fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4a4b90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x734fd0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c4], 0x190
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1c0]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a4bd1
mov byte [ebp - 0x1c0], 0
lea edx, [ebp - 0x1c0]
push edx
mov ecx, dword [ebp + 8]
call fcn.0048d330
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005f2c33
mov esp, ebp
pop ebp
ret

Function at 0x4a4c10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x734fd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x84], 0x76
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4a4c51
mov byte [ebp - 0x80], 0
lea edx, [ebp - 0x80]
push edx
mov ecx, dword [ebp + 8]
call fcn.0048d330
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005f2c33
mov esp, ebp
pop ebp
ret
Function at 0x4af5a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ebp + 0xc], 0
je 0x4af5c4
cmp dword [ebp + 8], 0
jne 0x4af5e3
cmp dword [ebp + 0x18], 0
je 0x4af5dc
push str.NULL_buf_or_bufSize
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 0x14]
call edx
xor al, al
jmp 0x4af6dd
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0xffffffff
je 0x4af659
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4af644
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26
jne 0x4af629
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x4af6dd
cmp dword [ebp + 0x18], 0
je 0x4af63b
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004a5e70
xor al, al
jmp 0x4af6dd
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x4af652
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x4af6dd
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x4af6c3
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.005f8fc7
add esp, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
cmp eax, dword [ebp + 0xc]
jne 0x4af690
mov al, 1
jmp 0x4af6dd
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call fcn.005f8cf3
add esp, 4
test eax, eax
je 0x4af6b7
cmp dword [ebp + 0x18], 0
je 0x4af6b1
mov ecx, dword [ebp + 0x18]
call fcn.004a5dd0
xor al, al
jmp 0x4af6dd
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov al, 1
jmp 0x4af6dd
cmp dword [ebp + 0x18], 0
je 0x4af6db
push str.No_file_is_open.
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x14]
call eax
xor al, al
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4af6f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.004aef40
movzx eax, al
test eax, eax
jne 0x4af727
cmp dword [ebp + 0x18], 0
je 0x4af720
push str.Failed_to_write_because_file_is_not_open.
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x14]
call eax
xor al, al
jmp 0x4af880
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x14], 0
je 0x4af743
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [ebp - 8], 0x989680
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x4af87e
mov ecx, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x1c]
jl 0x4af77b
jg 0x4af773
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x20]
jbe 0x4af77b
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
jmp 0x4af781
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 4], 0xffffffff
je 0x4af7f5
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4af7bd
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x10]
je 0x4af7f3
cmp dword [ebp + 0x18], 0
je 0x4af7ec
push 1
push str.WriteFileError
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov edx, dword [eax + 0x24]
call edx
mov ecx, dword [ebp + 0x18]
call fcn.004a5dd0
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x28]
call eax
xor al, al
jmp 0x4af880
jmp 0x4af83e
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 8], 0
je 0x4af83e
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 8]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.005f43d6
add esp, 0x10
cmp eax, 1
je 0x4af838
cmp dword [ebp + 0x18], 0
je 0x4af834
push str.fwrite_failed.
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx + 0x14]
call eax
xor al, al
jmp 0x4af880
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x14], 0
je 0x4af879
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp + 0x14]
add ecx, dword [eax]
mov eax, dword [eax + 4]
adc eax, edx
mov edx, dword [ebp + 0x14]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4af74a
mov al, 1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4af890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63bae8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x734fd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
cmp dword [eax + 4], 0xffffffff
je 0x4af932
push 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4af92d
cmp dword [ebp + 8], 0
je 0x4af92d
lea ecx, [ebp - 0x3c]
call fcn.0048df10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.004911c0
lea ecx, [ebp - 0x3c]
call fcn.00473440
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
call eax
push str.Failed_to_get_file_size__32_
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0048e2e0
mov eax, dword [ebp - 0x10]
jmp 0x4af95a
mov ecx, dword [ebp - 0x40]
cmp dword [ecx + 8], 0
je 0x4af957
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 8]
push eax
call fcn.006014c2
add esp, 4
push eax
call fcn.005f8fe4
add esp, 4
jmp 0x4af95a
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4af970
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63bef8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x734fd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
cmp dword [eax + 4], 0xffffffff
je 0x4afa40
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4afa22
cmp dword [ebp + 8], 0
je 0x4afa1a
lea ecx, [ebp - 0x4c]
call fcn.0048df10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004911c0
lea ecx, [ebp - 0x4c]
call fcn.00473440
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
call eax
push str.Failed_to_get_file_size__64_
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0048e2e0
or eax, 0xffffffff
or edx, 0xffffffff
jmp 0x4afa6b
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004afaa0
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
jmp 0x4afa6b
mov eax, dword [ebp - 0x50]
cmp dword [eax + 8], 0
je 0x4afa65
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 8]
push edx
call fcn.006014c2
add esp, 4
push eax
call fcn.005f90e3
add esp, 4
jmp 0x4afa6b
or eax, 0xffffffff
or edx, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bfb60
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x4bfb70
xor al, al
jmp 0x4bfbb9
cmp dword [ebp + 0xc], 0
jne 0x4bfb7a
xor al, al
jmp 0x4bfbb9
mov byte [ebp - 5], 0
call fcn.004a4d10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4bfb90
xor al, al
jmp 0x4bfbb9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4bfbaa
mov byte [ebp - 5], 1
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4c03a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
ja case.default.0x4c03bd
mov ecx, dword [ebp - 0x18]
jmp dword [ecx*4 + 0x4c054c]
mov dword [ebp - 4], 0
jmp 0x4c03d6
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 5
jge 0x4c03f2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov edx, dword [edx*4 + 0x694f88]
mov dword [ecx + eax*4 + 4], edx
jmp 0x4c03cd
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x28], 0
jmp case.default.0x4c03bd
mov dword [ebp - 8], 0
jmp 0x4c041d
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 8
jge 0x4c0439
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x6950a0]
mov dword [ecx + eax*4 + 4], edx
jmp 0x4c0414
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x28], 0
jmp case.default.0x4c03bd
mov dword [ebp - 0xc], 0
jmp 0x4c0464
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x4c0491
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax*8 + 0x6950c0]
mov edx, dword [eax*8 + 0x6950c4]
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [esi + eax*8 + 0xac], ecx
mov dword [esi + eax*8 + 0xb0], edx
jmp 0x4c045b
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf0], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf8], 0
jmp case.default.0x4c03bd
mov dword [ebp - 0x10], 0
jmp 0x4c04d9
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 8
jge 0x4c0506
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax*8 + 0x695380]
mov edx, dword [eax*8 + 0x695384]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov dword [esi + eax*8 + 0xac], ecx
mov dword [esi + eax*8 + 0xb0], edx
jmp 0x4c04d0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf0], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf4], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf8], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4c0bf0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
ja case.default.0x4c0c0f
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x4c0d94]
mov dword [ebp - 4], 0
jmp 0x4c0c28
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x4c0c44
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x694f88]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4c0c1f
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x4c0c0f
mov dword [ebp - 8], 0
jmp 0x4c0c6f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x4c0c8b
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax*4 + 0x6950a0]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4c0c66
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], 0
jmp case.default.0x4c0c0f
mov dword [ebp - 0xc], 0
jmp 0x4c0cb6
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jge 0x4c0ce3
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx*8 + 0x6950c0]
mov eax, dword [ecx*8 + 0x6950c4]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x4c0cad
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
jmp case.default.0x4c0c0f
mov dword [ebp - 0x10], 0
jmp 0x4c0d2b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
jge 0x4c0d58
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx*8 + 0x695380]
mov eax, dword [ecx*8 + 0x695384]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov dword [esi + ecx*8 + 0xac], edx
mov dword [esi + ecx*8 + 0xb0], eax
jmp 0x4c0d22
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xec], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0xf0], 0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xf4], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xf8], 0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4cc860
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], 0x10325476
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], 0xc3d2e1f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esp, ebp
pop ebp
ret
Function at 0x4ce3f0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0x98badcfe
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x4d58e0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [0x74e810]
test eax, eax
jne 0x4d59ce
push 0x400
call fcn.005cdeb0
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [0x74e814], ecx
mov dword [ebp - 4], 0x4c11db7
mov dword [ebp - 8], 0
jmp 0x4d5927
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xff
ja 0x4d59c7
push 8
mov eax, dword [ebp - 8]
push eax
call fcn.004d5a00
add esp, 8
shl eax, 0x18
mov ecx, dword [ebp - 8]
mov edx, dword [0x74e814]
mov dword [edx + ecx*4], eax
mov dword [ebp - 0xc], 0
jmp 0x4d5963
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 8
jae 0x4d59a0
mov ecx, dword [ebp - 8]
mov edx, dword [0x74e814]
mov eax, dword [edx + ecx*4]
shl eax, 1
mov ecx, dword [ebp - 8]
mov edx, dword [0x74e814]
mov ecx, dword [edx + ecx*4]
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 4]
xor eax, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [0x74e814]
mov dword [ecx + edx*4], eax
jmp 0x4d595a
push 0x20
mov edx, dword [ebp - 8]
mov eax, dword [0x74e814]
mov ecx, dword [eax + edx*4]
push ecx
call fcn.004d5a00
add esp, 8
mov edx, dword [ebp - 8]
mov ecx, dword [0x74e814]
mov dword [ecx + edx*4], eax
jmp 0x4d591e
mov byte [0x74e810], 1
mov esp, ebp
pop ebp
ret
Function at 0x51c760
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x640731
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x734fd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [eax], vtable.AesCrypt.0
mov ecx, dword [ebp - 0x24]
add ecx, 8
call fcn.0048df10
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00473e50
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.00473e50
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x70], 0x80
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x74], 0
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x78], 0
push 0x10
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.005f4bd0
add esp, 0xc
push 0x10
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x50
call fcn.00476360
push 0x10
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x30
call fcn.00476360
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f2c33
mov esp, ebp
pop ebp
ret

Function at 0x527d00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x527d0e
or eax, 0xffffffff
jmp 0x527d4c
cmp dword [ebp + 0x10], 0
jne 0x527d19
or eax, 0xffffffff
jmp 0x527d4c
mov eax, dword [ebp + 0x10]
push eax
call fcn.005f6a20
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x527d49
xor eax, eax
jmp 0x527d4c
or eax, 0xffffffff
pop ebp
ret