joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411570
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4453fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x455670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0041a568
push 4
mov dword [ebp - 4], 0
call fcn.0041b5ff
mov edi, eax
add esp, 4
test edi, edi
je 0x4115f0
call fcn.0041a07a
mov dword [edi], eax
call fcn.00419dbb
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00419c24
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4115e6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00419c4c
jmp 0x4115f2
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b411
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x455670]
jne 0x41b41b
repz ret
jmp fcn.004205fb

Function at 0x4227cd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4227f4
call fcn.0041c8bd
mov dword [eax], esi
call fcn.0041c8aa
push 0x16
pop esi
mov dword [eax], esi
call fcn.004216f0
mov eax, esi
jmp 0x422849
test dword [ebp + 0xc], 0xfffffff9
jne 0x4227da
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x422821
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041c8d0
pop ecx
call fcn.0041c8aa
mov eax, dword [eax]
jmp 0x422849
test al, 0x10
jne 0x422847
test al, 1
je 0x422847
test byte [ebp + 0xc], 2
je 0x422847
call fcn.0041c8bd
mov dword [eax], 5
call fcn.0041c8aa
mov dword [eax], 0xd
jmp 0x422818
xor eax, eax
pop esi
pop ebp
ret
Function at 0x434ec7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x455670]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00421c39
and dword [ebp - 0x14], 0
cmp dword [0x457cb0], 0
mov dword [ebp - 0x18], eax
jne 0x434f7a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x435022
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x435022
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x457cb0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x457cb4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x457cb8], eax
call edi
push eax
call esi
mov dword [0x457cc0], eax
test eax, eax
je 0x434f7a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x457cbc], eax
mov eax, dword [0x457cbc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x434fd3
cmp dword [0x457cc0], ecx
je 0x434fd3
push eax
call esi
push dword [0x457cc0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x434fd3
test ebx, ebx
je 0x434fd3
call edi
test eax, eax
je 0x434fca
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x434fca
test byte [ebp - 8], 1
jne 0x434fd3
or dword [ebp + 0x10], 0x200000
jmp 0x435006
mov eax, dword [0x457cb4]
cmp eax, dword [ebp - 0x18]
je 0x435006
push eax
call esi
test eax, eax
je 0x435006
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x435006
mov eax, dword [0x457cb8]
cmp eax, dword [ebp - 0x18]
je 0x435006
push eax
call esi
test eax, eax
je 0x435006
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x457cb0]
call esi
test eax, eax
je 0x435022
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x435024
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b411
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
xor ebx, ebx
push esi
xor ecx, ecx
inc ebx
push edi
mov eax, ebx
mov esi, 0xff
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea edi, [eax + eax]
xor edx, edi
xor edx, eax
and edx, esi
mov dword [ebp + ecx*4 - 0x80c], eax
mov dword [ebp + eax*4 - 0x40c], ecx
inc ecx
cmp ecx, 0x100
mov eax, edx
jl 0x401018
mov eax, ebx
mov ecx, 0x4db360
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, esi
add ecx, 4
cmp ecx, 0x4db388
mov eax, edx
jl 0x401050
mov byte [0x4dd488], 0x63
mov byte [0x4dc3eb], 0
mov eax, dword [ebp + ebx*4 - 0x40c]
shl eax, 2
lea ecx, [ebp - 0x410]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, esi
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, esi
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, esi
xor eax, edx
mov byte [ebx + 0x4dd488], al
mov byte [eax + 0x4dc388], bl
inc ebx
cmp ebx, 0x100
jl 0x401082
xor edi, edi
movzx edx, byte [edi + 0x4dd488]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x1b
lea eax, [edx + edx]
xor ecx, eax
and ecx, esi
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
mov ecx, edi
shl ecx, 2
mov dword [ecx + 0x4dd088], eax
rol eax, 8
mov dword [ecx + 0x4dcc88], eax
rol eax, 8
mov dword [ecx + 0x4dc888], eax
rol eax, 8
mov dword [ecx + 0x4dc488], eax
movzx eax, byte [edi + 0x4dc388]
test eax, eax
je 0x401163
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d4]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 4], eax
jmp 0x401167
and dword [ebp - 4], 0
movzx eax, byte [edi + 0x4dc388]
test eax, eax
je 0x401190
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 0xc], eax
jmp 0x401194
and dword [ebp - 0xc], 0
movzx eax, byte [edi + 0x4dc388]
test eax, eax
je 0x4011bd
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3d8]
mov ebx, esi
cdq
idiv ebx
mov eax, dword [ebp + edx*4 - 0x80c]
mov dword [ebp - 8], eax
jmp 0x4011c1
and dword [ebp - 8], 0
movzx eax, byte [edi + 0x4dc388]
test eax, eax
je 0x4011e7
mov eax, dword [ebp + eax*4 - 0x40c]
add eax, dword [ebp - 0x3e0]
mov ebx, esi
cdq
idiv ebx
mov edx, dword [ebp + edx*4 - 0x80c]
jmp 0x4011e9
xor edx, edx
shl edx, 8
xor edx, dword [ebp - 8]
shl edx, 8
xor edx, dword [ebp - 0xc]
shl edx, 8
xor edx, dword [ebp - 4]
inc edi
mov dword [ecx + 0x4dbf88], edx
rol edx, 8
mov eax, edx
mov dword [ecx + 0x4dbb88], eax
rol eax, 8
mov dword [ecx + 0x4db788], eax
rol eax, 8
cmp edi, 0x100
mov dword [ecx + 0x4db388], eax
jl 0x4010e5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4014c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x118
sub eax, 0x80
push edi
je 0x401500
sub eax, 0x40
je 0x4014f5
sub eax, 0x40
jne 0x4015f4
mov edi, dword [ebp + 8]
mov dword [edi], 0xe
jmp 0x401509
mov edi, dword [ebp + 8]
mov dword [edi], 0xc
jmp 0x401509
mov edi, dword [ebp + 8]
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push dword [ebp + 0xc]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.00401230
mov eax, dword [ebp - 0x118]
shl eax, 4
add eax, dword [ebp - 0x114]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
push 4
pop ecx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
mov edi, dword [edi]
add esi, ecx
dec edi
sub eax, 0x1c
test edi, edi
jle 0x4015c3
push ebx
mov dword [ebp + 0x10], ecx
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x4dd488]
movzx ebx, byte [eax + 2]
movzx ebx, byte [ebx + 0x4dd488]
mov edx, dword [edx*4 + 0x4db388]
xor edx, dword [ebx*4 + 0x4db788]
movzx ebx, byte [eax + 1]
movzx ebx, byte [ebx + 0x4dd488]
xor edx, dword [ebx*4 + 0x4dbb88]
mov ebx, dword [eax]
and ebx, 0xff
movzx ebx, byte [ebx + 0x4dd488]
xor edx, dword [ebx*4 + 0x4dbf88]
add eax, ecx
mov dword [esi], edx
add esi, ecx
dec dword [ebp + 0x10]
jne 0x401563
dec edi
sub eax, 0x20
test edi, edi
jg 0x401560
pop ebx
mov edx, dword [eax]
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
add esi, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
push 0x118
mov dword [esi + 4], eax
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0046b120
add esp, 0xc
pop esi
pop edi
leave
ret
Function at 0x401f4e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0xf84]
mov eax, 0x1004
call fcn.0046b520
mov eax, dword [0x4d9d10]
xor eax, ebp
mov dword [ebp + 0xf80], eax
push esi
push 0xfc7
lea eax, [ebp - 0x47]
mov esi, ecx
push 0
push eax
mov dword [esi], vtable.cAESFile.0
mov byte [ebp - 0x80], 0x2e
mov byte [ebp - 0x7f], 0x23
mov byte [ebp - 0x7e], 0x5e
mov byte [ebp - 0x7d], 0x4e
mov byte [ebp - 0x7c], 0x47
mov byte [ebp - 0x7b], 0x61
mov byte [ebp - 0x7a], 0x71
mov byte [ebp - 0x79], 0x39
mov byte [ebp - 0x78], 0x77
mov byte [ebp - 0x77], 0x32
mov byte [ebp - 0x76], 0x3e
mov byte [ebp - 0x75], 0x23
mov byte [ebp - 0x74], 0x38
mov byte [ebp - 0x73], 0x30
mov byte [ebp - 0x72], 0x6f
mov byte [ebp - 0x71], 0x30
mov byte [ebp - 0x70], 0x6f
mov byte [ebp - 0x6f], 0x66
mov byte [ebp - 0x6e], 0x6b
mov byte [ebp - 0x6d], 0x77
mov byte [ebp - 0x6c], 0x74
mov byte [ebp - 0x6b], 0x66
mov byte [ebp - 0x6a], 0x5b
mov byte [ebp - 0x69], 0x4d
mov byte [ebp - 0x68], 0x79
mov byte [ebp - 0x67], 0x43
mov byte [ebp - 0x66], 0x68
mov byte [ebp - 0x65], 0x73
mov byte [ebp - 0x64], 0x5d
mov byte [ebp - 0x63], 0x21
mov byte [ebp - 0x62], 0x23
mov byte [ebp - 0x61], 0x40
mov byte [ebp - 0x60], 0x25
mov byte [ebp - 0x5f], 0x4f
mov byte [ebp - 0x5e], 0x4c
mov byte [ebp - 0x5d], 0x4f
mov byte [ebp - 0x5c], 0x6c
mov byte [ebp - 0x5b], 0x73
mov byte [ebp - 0x5a], 0x6b
mov byte [ebp - 0x59], 0x72
mov byte [ebp - 0x58], 0x6f
mov byte [ebp - 0x57], 0x67
mov byte [ebp - 0x56], 0x61
mov byte [ebp - 0x55], 0x33
mov byte [ebp - 0x54], 0x65
mov byte [ebp - 0x53], 0x38
mov byte [ebp - 0x52], 0x61
mov byte [ebp - 0x51], 0x73
mov byte [ebp - 0x50], 0x38
mov byte [ebp - 0x4f], 0x32
mov byte [ebp - 0x4e], 0x31
mov byte [ebp - 0x4d], 0x34
mov byte [ebp - 0x4c], 0x2a
mov byte [ebp - 0x4b], 0x3c
mov byte [ebp - 0x4a], 0x2f
mov byte [ebp - 0x49], 0x5e
mov byte [ebp - 0x48], 0
call fcn.0046b120
push 0x1000
lea eax, [ebp - 0x80]
push eax
lea eax, [esi + 0x1010]
push eax
mov dword [esi + 4], 2
mov dword [esi + 0xc], 0x547015a
call fcn.0046b1a0
mov ecx, dword [ebp + 0xf80]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0046b510
add ebp, 0xf84
leave
ret
Function at 0x4020c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0046b520
mov eax, dword [0x4d9d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfc7
lea eax, [ebp - 0xfcb]
push 0
push eax
mov esi, ecx
mov byte [ebp - 0x1004], 0x2e
mov byte [ebp - 0x1003], 0x23
mov byte [ebp - 0x1002], 0x5e
mov byte [ebp - 0x1001], 0x4e
mov byte [ebp - 0x1000], 0x47
mov byte [ebp - 0xfff], 0x61
mov byte [ebp - 0xffe], 0x71
mov byte [ebp - 0xffd], 0x39
mov byte [ebp - 0xffc], 0x77
mov byte [ebp - 0xffb], 0x32
mov byte [ebp - 0xffa], 0x3e
mov byte [ebp - 0xff9], 0x23
mov byte [ebp - 0xff8], 0x38
mov byte [ebp - 0xff7], 0x30
mov byte [ebp - 0xff6], 0x6f
mov byte [ebp - 0xff5], 0x30
mov byte [ebp - 0xff4], 0x6f
mov byte [ebp - 0xff3], 0x66
mov byte [ebp - 0xff2], 0x6b
mov byte [ebp - 0xff1], 0x77
mov byte [ebp - 0xff0], 0x74
mov byte [ebp - 0xfef], 0x66
mov byte [ebp - 0xfee], 0x5b
mov byte [ebp - 0xfed], 0x4d
mov byte [ebp - 0xfec], 0x79
mov byte [ebp - 0xfeb], 0x43
mov byte [ebp - 0xfea], 0x68
mov byte [ebp - 0xfe9], 0x73
mov byte [ebp - 0xfe8], 0x5d
mov byte [ebp - 0xfe7], 0x21
mov byte [ebp - 0xfe6], 0x23
mov byte [ebp - 0xfe5], 0x40
mov byte [ebp - 0xfe4], 0x25
mov byte [ebp - 0xfe3], 0x4f
mov byte [ebp - 0xfe2], 0x4c
mov byte [ebp - 0xfe1], 0x4f
mov byte [ebp - 0xfe0], 0x6c
mov byte [ebp - 0xfdf], 0x73
mov byte [ebp - 0xfde], 0x6b
mov byte [ebp - 0xfdd], 0x72
mov byte [ebp - 0xfdc], 0x6f
mov byte [ebp - 0xfdb], 0x67
mov byte [ebp - 0xfda], 0x61
mov byte [ebp - 0xfd9], 0x33
mov byte [ebp - 0xfd8], 0x65
mov byte [ebp - 0xfd7], 0x38
mov byte [ebp - 0xfd6], 0x61
mov byte [ebp - 0xfd5], 0x73
mov byte [ebp - 0xfd4], 0x38
mov byte [ebp - 0xfd3], 0x32
mov byte [ebp - 0xfd2], 0x31
mov byte [ebp - 0xfd1], 0x34
mov byte [ebp - 0xfd0], 0x2a
mov byte [ebp - 0xfcf], 0x3c
mov byte [ebp - 0xfce], 0x2f
mov byte [ebp - 0xfcd], 0x5e
mov byte [ebp - 0xfcc], 0
call fcn.0046b120
xor eax, eax
add esp, 0xc
cmp dword [esi + 4], eax
jle 0x4022a0
mov ecx, dword [eax*4 + 0x4ad8dc]
cmp ecx, dword [ebp + 8]
je 0x4022b1
inc eax
cmp eax, dword [esi + 4]
jl 0x40228e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046b510
leave
ret 4
mov eax, ecx
mov dword [esi + 8], eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
add esi, 0x10
push esi
call fcn.0046b1a0
xor eax, eax
add esp, 0xc
inc eax
jmp 0x4022a2
Function at 0x4022d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x724
mov eax, dword [0x4d9d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x60c], eax
cmp ebx, edi
je 0x40243f
cmp eax, edi
je 0x40243f
push ebx
push 1
lea eax, [ebp - 0x607]
push 1
push eax
call fcn.0046c780
push 0x200
lea eax, [ebp - 0x604]
push edi
push eax
call fcn.0046b120
add esi, 0x10
push esi
call fcn.0046bb00
push eax
lea eax, [ebp - 0x604]
push esi
push eax
call fcn.0046b1a0
push 0x100
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x724]
push eax
call fcn.004014c8
mov al, byte [ebp + 0x14]
xor esi, esi
add esp, 0x38
cmp dword [ebp + 0x10], esi
mov byte [ebp - 0x605], al
jle 0x4023ca
push ebx
push 0x10
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0046c780
add esp, 0x10
cmp eax, 0x10
jne 0x4023f9
lea eax, [ebp - 0x404]
push eax
push eax
lea eax, [ebp - 0x724]
push esi
push eax
call fcn.004015f7
mov ecx, dword [ebp - 0x60c]
add esp, 0x10
xor eax, eax
lea esi, [ecx + edi]
mov cl, byte [ebp + eax - 0x404]
add byte [ebp - 0x605], cl
mov byte [esi + eax], cl
inc eax
cmp eax, 0x10
jl 0x4023aa
add edi, 0x10
xor esi, esi
cmp edi, dword [ebp + 0x10]
jl 0x40236e
push ebx
push 1
lea eax, [ebp - 0x606]
push 1
push eax
call fcn.0046c780
mov al, byte [ebp - 0x607]
add esp, 0x10
cmp al, byte [ebp - 0x606]
jne 0x402406
cmp al, byte [ebp - 0x605]
jne 0x402406
xor eax, eax
inc eax
jmp 0x402441
push esi
push str.Error__
push str.fread_Error__
jmp 0x402411
push esi
push str.Error__
push str.CheckCrc_Error__
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
lea eax, [ebp - 0x404]
push esi
push eax
call fcn.0046b120
push 0x118
lea eax, [ebp - 0x724]
push esi
push eax
call fcn.0046b120
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046b510
leave
ret 0x10

Function at 0x403eaa
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
push 0x40
lea esi, [ecx + 0x5c]
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.0046b120
add esp, 0xc
mov byte [esi], 0x80
pop esi
ret
Function at 0x404702
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4d9d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x48], eax
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0xc]
push 0x4aea1c
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.0046f090
add esp, 0xc
cmp dword [ebp - 0x40], ebx
jne 0x40474e
xor al, al
jmp 0x40482d
push esi
push 2
push ebx
push dword [ebp - 0x40]
call fcn.0046b8b0
push dword [ebp - 0x40]
call fcn.0046eaa0
push ebx
push ebx
push dword [ebp - 0x40]
mov esi, eax
call fcn.0046b8b0
push esi
call fcn.0046ea70
push dword [ebp - 0x40]
mov edi, eax
push esi
push 1
push edi
call fcn.0046c780
mov ecx, dword [ebp - 0x44]
add esp, 0x30
push esi
push edi
call fcn.004045ce
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x14]
push eax
call fcn.00404673
cmp edi, ebx
je 0x4047a6
push edi
call fcn.0040fb40
pop ecx
push dword [ebp - 0x40]
call fcn.0046e860
pop ecx
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x37]
mov byte [ebp - 0x38], bl
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x3b]
mov byte [ebp - 0x3c], bl
stosw word es:[edi], ax
xor esi, esi
push 0x10
lea eax, [ebp - 0x3c]
push eax
movzx eax, byte [ebp + esi - 0x14]
push eax
call fcn.004a2e90
add esp, 0xc
cmp byte [ebp - 0x3b], bl
jne 0x4047ff
lea eax, [ebp - 0x38]
push 0x4aea18
push eax
call fcn.0046e770
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046e770
add esp, 0x10
jmp 0x40480e
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0046e770
pop ecx
pop ecx
inc esi
cmp esi, 0x10
jl 0x4047c6
lea eax, [ebp - 0x38]
push eax
call fcn.004a2940
pop ecx
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push eax
call fcn.00403328
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0046b510
leave
ret 8
Function at 0x407b8b
Capabilities:
Write file on windows

Disassembly:
push 0x60
mov eax, 0x4a77b7
call fcn.0046e4c0
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x34], edi
cmp dword [esi + 0x3c], edi
je 0x407d17
cmp byte [esi + 0x41], 0
je 0x407d17
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x407bc4
xor al, al
jmp 0x407d19
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004079a6
mov dword [ebp - 4], edi
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00407b49
mov edi, eax
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00407b49
mov dword [ebp - 0x38], eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.004063af
mov ecx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x18]
mov ebx, eax
call fcn.004063af
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
lea ecx, [ebp - 0x48]
mov edi, eax
mov byte [ebp - 4], 1
call fcn.00402930
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0
call fcn.00402930
mov eax, edi
sub eax, 0
je 0x407c71
dec eax
je 0x407c75
dec eax
dec eax
je 0x407d10
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00402a4f
lea ecx, [ebp - 0x30]
call fcn.0040265a
mov al, bl
jmp 0x407d19
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x30]
call fcn.00407b49
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004063af
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x60]
sub edi, eax
mov byte [ebp - 4], 0
call fcn.00402930
test edi, edi
jbe 0x407cd3
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x30]
call fcn.00407b49
or dword [ebp - 0x34], 1
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.004063af
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0046bb90
add esp, 0x10
cmp edi, eax
je 0x407cd3
mov bl, 1
jmp 0x407cd5
xor bl, bl
and dword [ebp - 4], 0
test byte [ebp - 0x34], 1
je 0x407ceb
and dword [ebp - 0x34], 0xfffffffe
lea ecx, [ebp - 0x54]
call fcn.00402930
test bl, bl
jne 0x407c50
cmp byte [esi + 0x41], bl
je 0x407d10
test edi, edi
jne 0x407bd2
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004074af
jmp 0x407bd2
mov bl, 1
jmp 0x407c52
mov al, 1
call fcn.0046e560
ret
Function at 0x4087c6
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
sub esp, 0x50
lea ebp, [esp - 4]
mov eax, dword [0x4d9d10]
xor eax, ebp
mov dword [ebp + 0x50], eax
push 0x44
mov eax, 0x4a79a1
call fcn.0046e440
lea ecx, [ebp + 0x10]
call fcn.00402c19
xor ebx, ebx
lea ecx, [ebp + 0x30]
mov dword [ebp - 4], ebx
call fcn.00402c19
mov edi, 0x4dd640
push edi
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.00403328
push str.ImageAutopatchUpDataLuch.exe
lea ecx, [ebp + 0x10]
call fcn.0040338c
push 0x4ddcc8
lea ecx, [ebp + 0x30]
call fcn.00403328
push 0x4b100c
lea ecx, [ebp + 0x30]
call fcn.0040338c
mov esi, 0x4dddc8
push esi
lea ecx, [ebp + 0x30]
call fcn.0040338c
push 0x4b102c
lea ecx, [ebp + 0x30]
call fcn.0040338c
push edi
lea ecx, [ebp + 0x30]
call fcn.0040338c
push 0x4ae888
lea ecx, [ebp + 0x30]
call fcn.0040338c
push esi
lea ecx, [ebp + 0x30]
call fcn.0040338c
push 0x10
pop edi
push edi
lea eax, [ebp]
push ebx
push eax
call fcn.0046b120
push 0x44
pop esi
push esi
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.0046b120
mov ecx, dword [ebp + 0x38]
add esp, 0x18
mov dword [ebp - 0x50], esi
cmp dword [ebp + 0x4c], edi
jae 0x408899
lea ecx, [ebp + 0x38]
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x2c], edi
jae 0x4088a4
lea eax, [ebp + 0x18]
lea edx, [ebp]
push edx
lea edx, [ebp - 0x50]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4088d0
push dword [ebp]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 4]
call esi
jmp 0x4088ea
push ebx
push ebx
push str.Failed_to_run
call fcn.00429140
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
push ebx
push edi
call fcn.0042e8c0
mov ecx, eax
call fcn.0041e410
push ebx
push 1
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], bl
call fcn.00402a4f
lea ecx, [ebp + 0x30]
call fcn.0040265a
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x10]
call fcn.00402a4f
lea ecx, [ebp + 0x10]
call fcn.0040265a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x50]
xor ecx, ebp
call fcn.0046b510
add ebp, 0x54
leave
ret