joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457570
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0xffffffffffffffff
push 0x4da94b
mov eax, dword fs:[0]
push eax
mov eax, 0xac
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0xbc]
mov dword fs:[0], eax
mov esi, dword [esp + 0xcc]
mov ebp, dword [esp + 0xd0]
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.00424cc0
push 0x7f
lea eax, [esp + 0x3d]
push 0
push eax
mov dword [esp + 0xd0], 0
mov byte [esp + 0x44], 0
call fcn.00468ca0
add esp, 0xc
cmp dword [esi + 0x18], 8
jb 0x4575f3
mov esi, dword [esi + 4]
jmp 0x4575f6
add esi, 4
push 0
push esi
lea ecx, [esp + 0x1c]
call fcn.00424d40
lea ecx, [esp + 0x14]
call fcn.00424740
test al, al
jne 0x45762c
push str.Error_reading_file_for_test_n
call fcn.0041a700
add esp, 4
mov dword [esp + 0xc4], 0xffffffff
jmp 0x4576e1
lea ecx, [esp + 0x14]
call fcn.00424be0
test edx, edx
jg 0x457649
jl 0x457642
cmp eax, 0x198
jae 0x457649
push str.Test_file_is_too_small_n
jmp 0x457614
push 0
push 0x80
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
lea ecx, [esp + 0x28]
call fcn.00424750
push 0x254
add ebp, 8
push ebp
mov ecx, edi
call fcn.00455e40
test al, al
je 0x45761c
mov ecx, dword [edi + 0x34]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x3c]
push eax
push 0
or esi, 0xffffffff
push esi
push 0
push ecx
mov dword [esp + 0x28], 0x80
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4576c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_decrypting_header__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
jmp 0x4576da
lea edx, [esp + 0x38]
push 0x10
push edx
call fcn.0041a7a0
add esp, 8
mov byte [edi + 0x20], al
mov dword [esp + 0xc4], esi
lea ecx, [esp + 0x14]
call fcn.00424ce0
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.004690b5
add esp, 0xb8
ret 8
Function at 0x458150
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov eax, 0x3fc
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x3f8], eax
mov eax, dword [esp + 0x400]
push ebx
push ebp
push esi
push edi
push 0x3df
mov edi, ecx
xor esi, esi
lea ecx, [esp + 0x2d]
push esi
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x34], 0
call fcn.00468ca0
mov eax, dword [edi + 0x28]
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push esi
push esi
push eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x4581c2
call fcn.0043a470
jmp 0x4582a0
call fcn.00424be0
add eax, 0xfffffff0
adc edx, 0xffffffff
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
cmp edx, esi
jb 0x458282
ja 0x4581f8
cmp eax, esi
jbe 0x458282
jmp 0x4581f8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov esi, eax
sub esi, ebx
mov edi, edx
sbb edi, ebp
jne 0x45820a
cmp esi, 0x3e0
jbe 0x458213
mov esi, 0x3e0
xor edi, edi
jmp 0x45821b
mov dword [esp + 0x14], 1
push edi
push esi
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ebx
call fcn.00424750
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
push 0
push edx
mov dword [esp + 0x38], esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, dword [esp + 0x10]
push edi
push esi
lea eax, [esp + 0x30]
push eax
push ebp
push ebx
call fcn.00424860
cmp dword [esp + 0x14], 0
jne 0x458282
add ebx, esi
adc ebp, edi
cmp ebp, dword [esp + 0x1c]
jb 0x4581f0
ja 0x458282
cmp ebx, dword [esp + 0x18]
jb 0x4581f0
sub esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push 0
add esi, 0x10
push esi
call fcn.00424c20
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x3fc
ret 8
Function at 0x458c50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x128
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push edi
mov edi, dword [esp + 0x134]
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov ecx, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00424be0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
cmp ebx, edx
ja 0x458d96
mov ecx, dword [esp + 0xc]
jb 0x458cb4
cmp ecx, eax
jae 0x458d96
push ebp
push esi
jmp 0x458cd0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ebp, eax
sub ebp, ecx
mov esi, edx
sbb esi, ebx
jne 0x458ce2
cmp ebp, 0x100
jbe 0x458ce9
mov ebp, 0x100
xor esi, esi
push esi
push ebp
lea eax, [esp + 0x3c]
push eax
push ebx
push ecx
mov ecx, edi
call fcn.00424750
mov cl, byte [esp + 0x14]
sub cl, 4
xor edi, edi
test esi, esi
jb 0x458d48
ja 0x458d0c
test ebp, ebp
jbe 0x458d48
mov edx, dword [esp + 0x30]
mov bl, byte [edx + 0x24]
mov byte [esp + 0x13], bl
add bl, cl
lea esp, [esp]
mov al, bl
xor al, cl
xor al, 0xc3
mov dl, cl
sub dl, al
sub dl, byte [esp + 0x13]
inc edi
xor byte [esp + edi + 0x33], dl
mov eax, edi
cdq
inc cl
inc bl
cmp edx, esi
jb 0x458d20
ja 0x458d44
cmp eax, ebp
jb 0x458d20
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push esi
push ebp
lea eax, [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
push edi
call fcn.00424860
add dword [esp + 0x14], ebp
adc ebx, esi
add edi, ebp
adc dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edi
cmp ebx, dword [esp + 0x2c]
jb 0x458cc0
ja 0x458d90
mov edx, dword [esp + 0x28]
cmp dword [esp + 0x14], edx
jb 0x458cc0
mov edi, dword [esp + 0x1c]
pop esi
pop ebp
push 0
push 4
mov ecx, edi
call fcn.00424c20
mov ecx, dword [esp + 0x12c]
pop edi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x128
ret 8
Function at 0x458df0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4dab60
mov eax, dword fs:[0]
push eax
mov eax, 0x5c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov edi, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], ax
lea ecx, [esp + 0x34]
mov dword [esp + 0x74], ebx
call fcn.00424cc0
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x78], 1
call fcn.0041ae00
mov edx, dword [esp + 0x18]
add esp, 4
cmp eax, 7
je 0x458e80
push edx
call fcn.004690f0
push str.Wrong_pass_file_size_n
call fcn.0041a700
mov byte [esp + 0x7c], bl
jmp 0x458f9f
push 1
lea ecx, [esp + 0x5c]
push ecx
add edx, 5
push edx
call fcn.0041aba0
mov ecx, dword [esp + 0x20]
mov al, byte [esp + 0x64]
push ecx
mov byte [edi + 0x24], al
call fcn.004690f0
add esp, 0x10
cmp dword [0x584064], ebx
je 0x458eb8
mov ecx, 0x4f15b0
mov eax, 0x4e2e58
jmp 0x458ec2
mov ecx, 0x4f1560
mov eax, str.Choose_encrypted_doc_file
lea edx, [esp + 0x18]
push edx
push ecx
push eax
mov ecx, edi
call fcn.0042bd50
test al, al
jne 0x458edd
mov byte [esp + 0x74], bl
jmp 0x458fa2
push 0xa
push 0x4f1548
lea ecx, [edi + 4]
call fcn.0041c510
cmp dword [esp + 0x30], 8
mov eax, dword [esp + 0x1c]
jae 0x458efb
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x3c]
call fcn.00424d40
lea ecx, [esp + 0x34]
call fcn.00424740
test al, al
jne 0x458f3b
push str.Cant_open_test_file_n
call fcn.0041a700
add esp, 4
lea ecx, [esp + 0x34]
mov byte [esp + 0x74], bl
call fcn.00424ce0
lea ecx, [esp + 0x18]
call fcn.0041b5b0
jmp 0x458fbf
lea ecx, [esp + 0x34]
call fcn.00424be0
cmp edx, ebx
jg 0x458f4f
jl 0x458f20
cmp eax, 0x14
jb 0x458f20
push ebx
push 0x10
lea ecx, [esp + 0x60]
push ecx
push ebx
push 4
lea ecx, [esp + 0x48]
call fcn.00424750
mov dl, byte [edi + 0x24]
xor cl, cl
mov byte [esp + 0x13], dl
lea esi, [esp + 0x58]
mov bl, dl
xor bl, cl
xor bl, 0xc3
mov al, cl
sub al, bl
sub al, byte [esp + 0x13]
inc cl
xor byte [esi], al
inc dl
inc esi
cmp cl, 0x10
jb 0x458f70
lea edx, [esp + 0x58]
push 0x10
push edx
call fcn.0041a7a0
mov byte [edi + 0x20], al
mov byte [esp + 0x7c], 0
add esp, 8
lea ecx, [esp + 0x34]
call fcn.00424ce0
cmp dword [esp + 0x30], 8
jb 0x458fbf
mov eax, dword [esp + 0x1c]
push eax
call fcn.004699ce
add esp, 4
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004690b5
add esp, 0x68
ret
Function at 0x459010
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4daba3
mov eax, dword fs:[0]
push eax
mov eax, 4
call fcn.00468d20
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.00455c00
xor eax, eax
lea edi, [esi + 0x30]
mov dword [esi], vtable.Decryptor4608.0
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], eax
mov dword [esp + 0x18], eax
mov word [edi + 4], ax
lea ecx, [esi + 4]
mov byte [esp + 0x18], 1
call fcn.0041c620
mov ecx, edi
call fcn.0041c620
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4594c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov eax, 0x3fc
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x3f8], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x410]
push 0x3df
xor ebx, ebx
lea eax, [esp + 0x2d]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x20], edi
mov byte [esp + 0x34], 0
call fcn.00468ca0
mov edx, dword [esi + 0x28]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push edx
xor ebp, ebp
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
mov ecx, edi
test eax, eax
jne 0x45952a
call fcn.0043a470
jmp 0x4595fd
call fcn.00424be0
add eax, 0xfffffffc
adc edx, 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
cmp edx, ebx
jb 0x4595e7
ja 0x459559
cmp eax, ebx
jbe 0x4595e7
jmp 0x459559
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov esi, eax
sub esi, ebp
mov edi, edx
sbb edi, ebx
jne 0x45956b
cmp esi, 0x3e0
jbe 0x459574
mov esi, 0x3e0
xor edi, edi
jmp 0x45957c
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
push edi
push esi
lea eax, [esp + 0x30]
push eax
push ebx
push ebp
call fcn.00424750
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
push 0
push eax
push 0
push ecx
mov dword [esp + 0x3c], esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, dword [esp + 0x14]
push edi
push esi
lea edx, [esp + 0x30]
push edx
push ebx
push ebp
call fcn.00424860
cmp dword [esp + 0x10], 0
jne 0x4595e3
add ebp, esi
adc ebx, edi
cmp ebx, dword [esp + 0x20]
jb 0x459551
ja 0x4595e3
cmp ebp, dword [esp + 0x1c]
jb 0x459551
mov edi, dword [esp + 0x14]
push 0
push 4
mov ecx, edi
call fcn.00424c20
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 0x408]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x3fc
ret 8
Function at 0x459b60
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov eax, 0x498
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x494], eax
push ebx
push esi
mov esi, dword [esp + 0x4a4]
push edi
push 0x493
lea eax, [esp + 0x11]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x18], 0
call fcn.00468ca0
mov ebx, dword [esp + 0x4b8]
add esp, 0xc
cmp ebx, 0x494
ja 0x459c0e
push ebp
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.0041aba0
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
add esp, 0xc
push 0x10
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea esi, [edi + 0x24]
push esi
call ebp
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push esi
call ebp
pop ebp
test eax, eax
jne 0x459c12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_acquiring_context__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
xor al, al
jmp 0x459c5b
mov eax, dword [esi]
add edi, 0x28
push edi
push 0
push 0
push ebx
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x459c59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error_importing_key__0x_X__n
push 0x3ff
push 0x584090
call fcn.00469c7b
push 0x584090
call fcn.0041a5a0
add esp, 0x14
xor al, al
jmp 0x459c5b
mov al, 1
mov ecx, dword [esp + 0x4a0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x498
ret 8
Function at 0x45cc00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x128
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
mov ebp, dword [esp + 0x134]
push esi
push edi
mov edi, dword [ecx + 0x24]
xor ebx, ebx
mov dword [esp + 0x28], ecx
mov esi, 4
mov ecx, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
neg edi
call fcn.00424be0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
cmp ebx, edx
ja 0x45cd48
jb 0x45cc7c
cmp esi, eax
jae 0x45cd48
jmp 0x45cc7c
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x14]
mov ebp, eax
sub ebp, esi
mov esi, edx
sbb esi, ebx
jne 0x45cc8e
cmp ebp, 0x100
jbe 0x45cc95
mov ebp, 0x100
xor esi, esi
mov ecx, dword [esp + 0x14]
push esi
push ebp
lea eax, [esp + 0x3c]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x38]
call fcn.00424750
xor ecx, ecx
test esi, esi
jb 0x45ccfe
ja 0x45ccb7
test ebp, ebp
jbe 0x45ccfe
mov edx, dword [esp + 0x28]
mov ebx, dword [edx + 0x24]
mov eax, edx
mov dl, byte [eax + 0x24]
mov byte [esp + 0x13], dl
jmp 0x45ccd0
xor edx, edx
xor edi, 0xc4
mov eax, ebx
div edi
mov dl, cl
add dl, dl
add edi, 2
inc ecx
add al, dl
sub al, byte [esp + 0x13]
xor byte [esp + ecx + 0x33], al
xor eax, eax
cmp eax, esi
jb 0x45ccd0
ja 0x45ccfa
cmp ecx, ebp
jb 0x45ccd0
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push esi
push ebp
lea eax, [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x34]
push edx
call fcn.00424860
add dword [esp + 0x14], ebp
adc ebx, esi
add dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
adc dword [esp + 0x20], esi
cmp ebx, dword [esp + 0x30]
jb 0x45cc70
ja 0x45cd44
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x14], eax
jb 0x45cc70
mov ebp, dword [esp + 0x24]
push 0
push 4
mov ecx, ebp
call fcn.00424c20
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x128
ret 8
Function at 0x45cda0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4dac00
mov eax, dword fs:[0]
push eax
mov eax, 0x5c
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov ebp, ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
mov word [esp + 0x20], ax
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], esi
call fcn.00424cc0
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x7c], 1
call fcn.0041ae00
mov edx, dword [esp + 0x1c]
add esp, 4
cmp eax, 0xd
je 0x45ce4e
push edx
call fcn.004690f0
push str.Wrong_pass_file_size_n
call fcn.0041a700
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 0
call fcn.00424ce0
cmp dword [esp + 0x34], 8
jb 0x45cf95
mov eax, dword [esp + 0x20]
push eax
jmp 0x45cf8d
push 4
lea ecx, [esp + 0x60]
push ecx
add edx, 5
push edx
call fcn.0041aba0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x68]
push ecx
mov dword [ebp + 0x24], eax
call fcn.004690f0
add esp, 0x10
cmp dword [0x584064], esi
je 0x45ce86
mov ecx, 0x4f15b0
mov eax, 0x4e2e58
jmp 0x45ce90
mov ecx, 0x4f1560
mov eax, str.Choose_encrypted_doc_file
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
mov ecx, ebp
call fcn.0042bd50
test al, al
je 0x45ce2b
push 0xa
push 0x4f1548
lea ecx, [ebp + 4]
call fcn.0041c510
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x45cec0
lea eax, [esp + 0x20]
push esi
push eax
lea ecx, [esp + 0x40]
call fcn.00424d40
lea ecx, [esp + 0x38]
call fcn.00424740
test al, al
jne 0x45cf01
push str.Cant_open_test_file_n
call fcn.0041a700
add esp, 4
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 0
call fcn.00424ce0
lea ecx, [esp + 0x1c]
call fcn.0041b5b0
jmp 0x45cf95
lea ecx, [esp + 0x38]
call fcn.00424be0
cmp edx, esi
jg 0x45cf15
jl 0x45cee5
cmp eax, 0x14
jb 0x45cee5
push esi
push 0x10
lea ecx, [esp + 0x64]
push ecx
push esi
push 4
lea ecx, [esp + 0x4c]
call fcn.00424750
mov edi, dword [ebp + 0x24]
mov dl, byte [ebp + 0x24]
mov ecx, edi
neg ecx
mov byte [esp + 0x17], dl
xor bl, bl
lea esi, [esp + 0x5c]
lea ecx, [ecx]
xor ecx, 0xc4
xor edx, edx
mov eax, edi
div ecx
add ecx, 2
inc esi
sub al, byte [esp + 0x17]
add al, bl
xor byte [esi - 1], al
add bl, 2
cmp bl, 0x20
jb 0x45cf40
lea eax, [esp + 0x5c]
push 0x10
push eax
call fcn.0041a7a0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [ebp + 0x20], al
mov byte [esp + 0x78], 0
call fcn.00424ce0
cmp dword [esp + 0x34], 8
jb 0x45cf95
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004699ce
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004690b5
add esp, 0x68
ret
Function at 0x45dd10
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4dafe2
mov eax, dword fs:[0]
push eax
mov eax, 0x2c8
call fcn.00468d20
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x2c4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5808f0]
xor eax, esp
push eax
lea eax, [esp + 0x2dc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, 7
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ebp
mov word [esp + 0x70], cx
xor edx, edx
mov dword [esp + 0x2e4], ebp
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], dx
push 0x4e17f4
lea esi, [ebx + 0x68]
lea eax, [esp + 0x38]
push esi
push eax
mov byte [esp + 0x2f0], 1
call fcn.0042cd00
lea ecx, [ebx + 4]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x2fc], 2
call fcn.00436b20
add esp, 0x18
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x2f0], 3
call fcn.0041c410
mov edi, 8
cmp dword [esp + 0x30], edi
jb 0x45dde5
mov eax, dword [esp + 0x1c]
push eax
call fcn.004699ce
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], cx
mov byte [esp + 0x2e4], 1
cmp dword [esp + 0x4c], edi
jb 0x45de13
mov edx, dword [esp + 0x38]
push edx
call fcn.004699ce
add esp, 4
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x84], edi
jae 0x45de24
lea eax, [esp + 0x70]
lea ecx, [esp + 0x88]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x45def9
test byte [esp + 0x88], 0x10
jne 0x45dede
push 0x4e174c
lea edx, [esp + 0x38]
push esi
push edx
call fcn.0042cd00
lea ecx, [esp + 0xc0]
push ecx
push eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x2fc], 4
call fcn.0042cd00
add esp, 0x18
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x2f0], 5
call fcn.0041c410
cmp dword [esp + 0x30], edi
jb 0x45dea4
mov eax, dword [esp + 0x1c]
push eax
call fcn.004699ce
add esp, 4
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], cx
mov byte [esp + 0x2e4], 1
cmp dword [esp + 0x4c], edi
jb 0x45ded2
mov edx, dword [esp + 0x38]
push edx
call fcn.004699ce
add esp, 4
lea eax, [esp + 0x50]
push eax
mov ecx, ebx
call fcn.0045dc00
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x88]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45de40
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x68], edi
jb 0x45df17
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004699ce
add esp, 4
xor edx, edx
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], ebp
mov word [esp + 0x54], dx
cmp dword [esp + 0x84], edi
jb 0x45df40
mov eax, dword [esp + 0x70]
push eax
call fcn.004699ce
add esp, 4
mov ecx, dword [esp + 0x2dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c4]
xor ecx, esp
call fcn.004690b5
add esp, 0x2d4
ret
Function at 0x45e450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x408
call fcn.00468d20
push ebx
mov ebx, ecx
cmp byte [ebx + 0xab], 0
jne 0x45e546
push ebp
mov ebp, dword [ebx + 0xa4]
push esi
mov esi, dword [esp + 0x418]
push edi
mov ecx, esi
xor edi, edi
call fcn.00424be0
cmp edx, edi
jl 0x45e48d
jg 0x45e498
cmp eax, ebp
jae 0x45e498
mov ecx, esi
call fcn.00424be0
mov ebp, eax
mov edi, edx
push ebp
call fcn.004691cd
mov esi, eax
add esp, 4
test esi, esi
jne 0x45e4c0
mov ecx, dword [esp + 0x41c]
call fcn.0043a470
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 8
lea eax, [ebx + 0x24]
push eax
lea ecx, [esp + 0x14]
push 0x80
push ecx
call fcn.004d0170
mov ecx, dword [esp + 0x428]
add esp, 0xc
push edi
push ebp
push esi
push 0
push 0
call fcn.00424750
push esi
push esi
lea edx, [esp + 0x18]
push ebp
push edx
call fcn.004d0000
add esp, 0x10
cmp byte [ebx + 0xa8], 0
je 0x45e527
xor ecx, ecx
test edi, edi
jb 0x45e527
ja 0x45e510
test ebp, ebp
jbe 0x45e527
mov edi, edi
mov al, byte [ebx + 0xa8]
xor byte [ecx + esi], al
inc ecx
mov eax, ecx
cdq
cmp edx, edi
jb 0x45e510
ja 0x45e527
cmp eax, ebp
jb 0x45e510
mov ecx, dword [esp + 0x41c]
push edi
push ebp
push esi
push 0
push 0
call fcn.00424860
push esi
call fcn.004690f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret 8