joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4e3114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x412c57
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x412c5e
mov al, 1
jmp 0x412d51
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x48], edx
call fcn.00418de0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
call dword [0x4b5234]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
call fcn.00418de0
mov dword [ebp - 0x50], eax
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.00418e60
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x412cb3
xor al, al
jmp 0x412d51
mov dword [ebp - 0x58], 0x20
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x54]
call fcn.0041fdb0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x412cf5
cmp dword [ebp - 0x34], 1
je 0x412cfc
cmp dword [ebp - 0x34], 3
je 0x412d4b
jmp 0x412d4f
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3d], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x412d2b
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.0048e258
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x412d2b
xor al, al
jmp 0x412d51
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x412d3f
mov dword [ebp - 0x40], 1
jmp 0x412d46
mov dword [ebp - 0x40], 0
mov al, byte [ebp - 0x40]
jmp 0x412d51
mov al, 1
jmp 0x412d51
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bcfe
mov esp, ebp
pop ebp
ret
Function at 0x412d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4e3114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x412d87
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3e]
test edx, edx
jne 0x412d8e
mov al, 1
jmp 0x412e85
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x4c], edx
call fcn.00418dd0
mov word [ebp - 0x32], ax
movzx eax, word [ebp - 0x32]
push eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
call dword [0x4b5234]
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov word [ebp - 0x34], ax
call fcn.00418dd0
mov word [ebp - 0x36], ax
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x36]
push eax
call fcn.00418e30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x412de7
xor al, al
jmp 0x412e85
mov dword [ebp - 0x54], 0x20
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x50]
call fcn.0041fdb0
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x412e29
cmp dword [ebp - 0x3c], 1
je 0x412e30
cmp dword [ebp - 0x3c], 3
je 0x412e7f
jmp 0x412e83
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3e], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x40], eax
je 0x412e5f
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.0048e258
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x412e5f
xor al, al
jmp 0x412e85
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x3e]
test ecx, ecx
jne 0x412e73
mov dword [ebp - 0x48], 1
jmp 0x412e7a
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
jmp 0x412e85
mov al, 1
jmp 0x412e85
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bcfe
mov esp, ebp
pop ebp
ret
Function at 0x4157e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
jmp 0x4157fb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe3
jge 0x415867
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x41583f
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x415846
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xff8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x4157f2
jmp 0x415872
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x26f
jge 0x4158de
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x9c4]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 + 0x9c8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 1
je 0x4158b6
mov dword [ebp - 0x18], 0x9908b0df
jmp 0x4158bd
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
shr eax, 1
xor eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x415869
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4 + 0x9c4]
and edx, 0x80000000
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 4]
and ecx, 0x7fffffff
or edx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x41591c
mov dword [ebp - 0x20], 0x9908b0df
jmp 0x415923
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
shr eax, 1
xor eax, dword [ebp - 0x20]
mov ecx, 4
imul edx, ecx, 0x18c
mov ecx, dword [ebp - 8]
xor eax, dword [ecx + edx + 4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + edx*4 + 4], eax
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x415960
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x270
jmp 0x41597b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4e0
jge 0x4159e7
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 - 0x9bc]
and eax, 0x80000000
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + ecx*4 - 0x9b8]
and ecx, 0x7fffffff
or eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
and edx, 1
je 0x4159bf
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x4159c6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
xor eax, dword [edx + ecx*4 - 0x388]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx + ecx*4 + 4], eax
jmp 0x415972
mov esp, ebp
pop ebp
ret
Function at 0x41da20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x4e3114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.00418de0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.00418e60
add esp, 8
movzx edx, al
test edx, edx
je 0x41da64
lea eax, [ebp + 8]
push eax
call fcn.0041d800
add esp, 4
jmp 0x41dbf9
mov ecx, dword [ebp - 0x38]
call fcn.0041e1b0
test eax, eax
je 0x41daaa
mov ecx, dword [ebp - 0x38]
call fcn.0041e1b0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.00418df0
cmp esi, eax
jae 0x41daaa
lea ecx, [ebp + 8]
push ecx
call fcn.0041f550
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.00415560
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x41dbf9
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x41dabd
call fcn.00418de0
jmp 0x41dbf9
mov ecx, dword [ebp - 0x38]
call fcn.00415b70
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x41db16
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.0041f550
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.004039b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41db06
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x41db0e
call fcn.00418de0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x41dbf9
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.0041f550
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.0041d9d0
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x41dbf4
cmp dword [ebp - 0x40], 1
jle 0x41db77
cmp dword [ebp - 0x40], 3
je 0x41dbc4
jmp 0x41dbf4
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x41dba9
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0048e258
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x41dba9
call fcn.00418de0
jmp 0x41dbf9
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x41dbbd
mov eax, dword [ebp + 8]
jmp 0x41dbf9
call fcn.00418de0
jmp 0x41dbf9
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.004039b0
add esp, 8
movzx eax, al
test eax, eax
je 0x41dbe7
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x41dbef
call fcn.00418de0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x41dbf9
call fcn.00418de0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bcfe
mov esp, ebp
pop ebp
ret 4
Function at 0x41dc10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4e3114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.00418dd0
mov word [ebp - 0x3e], ax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x3e]
push ecx
call fcn.00418e30
add esp, 8
movzx edx, al
test edx, edx
je 0x41dc55
lea eax, [ebp + 8]
push eax
call fcn.0041d7a0
add esp, 4
jmp 0x41ddfc
mov ecx, dword [ebp - 0x38]
call fcn.0041e1b0
test eax, eax
je 0x41dc9f
mov ecx, dword [ebp - 0x38]
call fcn.0041e1b0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.00418e10
cmp esi, eax
jae 0x41dc9f
lea ecx, [ebp + 8]
push ecx
call fcn.0041f540
add esp, 4
mov word [ebp - 0x40], ax
mov ecx, dword [ebp - 0x38]
call fcn.004155b0
mov dx, word [ebp - 0x40]
mov word [eax], dx
mov ax, word [ebp + 8]
jmp 0x41ddfc
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x41dcb2
call fcn.00418dd0
jmp 0x41ddfc
mov ecx, dword [ebp - 0x38]
call fcn.00415bb0
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x41dd10
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x50], eax
lea ecx, [ebp + 8]
push ecx
call fcn.0041f540
add esp, 4
mov word [ebp - 0x42], ax
mov edx, dword [ebp - 0x50]
push edx
movzx eax, word [ebp - 0x42]
push eax
call fcn.004039f0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x41dcfe
mov dx, word [ebp + 8]
mov word [ebp - 0x3a], dx
jmp 0x41dd07
call fcn.00418dd0
mov word [ebp - 0x3a], ax
mov ax, word [ebp - 0x3a]
jmp 0x41ddfc
mov dword [ebp - 0x58], 0x20
lea eax, [ebp + 8]
push eax
call fcn.0041f540
add esp, 4
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2a]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x54]
call fcn.0041d9d0
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x41ddf7
cmp dword [ebp - 0x48], 1
jle 0x41dd75
cmp dword [ebp - 0x48], 3
je 0x41ddc3
jmp 0x41ddf7
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x4c], ecx
je 0x41dda7
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0048e258
add esp, 0x10
cmp dword [ebp - 0x4c], eax
je 0x41dda7
call fcn.00418dd0
jmp 0x41ddfc
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3e], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x34], edx
je 0x41ddbc
mov ax, word [ebp + 8]
jmp 0x41ddfc
call fcn.00418dd0
jmp 0x41ddfc
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
call fcn.004039f0
add esp, 8
movzx eax, al
test eax, eax
je 0x41dde8
mov cx, word [ebp + 8]
mov word [ebp - 0x3c], cx
jmp 0x41ddf1
call fcn.00418dd0
mov word [ebp - 0x3c], ax
mov ax, word [ebp - 0x3c]
jmp 0x41ddfc
call fcn.00418dd0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046bcfe
mov esp, ebp
pop ebp
ret 4
Function at 0x435450
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x435581
test al, 3
jne 0x435581
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x43553c
cmp edi, 8
jb 0x435505
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x4354b4
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x435540
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x435522
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x435544
xor edi, edi
jmp 0x435544
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x435558
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x435640
cmp ecx, 0x20
jb 0x43561a
mov esi, ecx
xorps xmm3, xmm3
and esi, 0xffffffe0
xorps xmm2, xmm2
mov dword [esp + 0x1c], esi
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x4355b5
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x435640
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
nop dword [eax]
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x435630
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x452ea0
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x4eb0e4], 0
jne 0x452eae
call fcn.00466970
cmp byte [0x4eb0ed], 0
je 0x452ecc
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00467790
add esp, 0x10
ret
jmp fcn.004511e0

Function at 0x452ee0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4afff8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4e3114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push 0xf0000000
push 1
push 0
push 0
push esi
mov dword [esi], 0
call edi
test eax, eax
jne 0x452f56
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 8
push 1
push 0
push str.Crypto_RNG
push esi
mov ebx, eax
call edi
test eax, eax
jne 0x452f56
push 0x28
push 1
push eax
push str.Crypto_RNG
push esi
call edi
test eax, eax
je 0x452f74
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046bcfe
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.CryptAcquireContext
lea ecx, [ebp - 0x28]
call fcn.00408040
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x50]
call fcn.00453040
push 0x4dd9a0
lea eax, [ebp - 0x50]
push eax
call fcn.00483148
int3
Function at 0x46ea51
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x49b94b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b60e

Function at 0x49b956
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049b78f

Function at 0x4a3c6c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a392c
Function at 0x401200
Capabilities:
Get common file path

Disassembly:
sub esp, 0x444
push ebx
push edi
mov edi, dword [esp + 0x460]
xor ebx, ebx
cmp edi, ebx
je 0x4013e9
mov ecx, dword [esp + 0x464]
cmp ecx, 0x104
jb 0x4013e9
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov dword [esp + 0x1c], ebx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x24]
push esi
mov esi, dword [esp + 0x458]
mov dword [esp + 0x14], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x460]
cmp eax, 0xffffffff
je 0x40127f
lea ecx, [esp + 0x14]
push ecx
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40127f
mov edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x45c]
cmp eax, ebx
je 0x4012ce
mov ecx, eax
shr ecx, 0x10
jne 0x4012ba
and eax, 0xffff
push ebx
lea edx, [esp + 0x48]
push eax
push edx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x4012ce
push 0x206
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
cmp byte [esp + 0x44], bl
jne 0x4012ea
cmp dword [esp + 0x28], ebx
jne 0x4012ea
lea ecx, [esp + 0x44]
push ecx
push 0x206
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x470]
mov eax, 1
cmp ecx, ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], eax
je 0x40130b
mov eax, 0x11
mov dword [esp + 0x34], eax
lea edx, [esp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x464]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x401400
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
xor ebp, ebp
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov esi, eax
cmp esi, ebx
je 0x401399
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x24c]
push ecx
push esi
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x401399
mov edx, dword [esp + 0x46c]
mov ecx, dword [esp + 0x468]
dec edx
lea eax, [esp + 0x24c]
push edx
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
mov ebp, 1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push edx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x4013dc
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4013dc
cmp esi, ebx
je 0x4013c3
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x4013d6
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebp
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x444
ret
pop edi
xor eax, eax
pop ebx
add esp, 0x444
ret