joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413043
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
add byte [eax], al
add byte [eax + 0x64], dl
mov dword [0], esp
push ecx
push ebx
mov ebx, dword [0x432174]
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov dword [esp + 0x10], esi
lea eax, [esi + 0x18]
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0xea60
mov byte [esi + 0x14], 0
push eax
mov dword [eax + 0x18], ebp
call ebx
lea eax, [esi + 0x34]
mov dword [esp + 0x1c], ebp
push eax
mov dword [eax + 0x18], ebp
call ebx
push 0x28
mov dword [esi + 0x54], ebp
mov dword [esi + 0x58], 5
call fcn.004266aa
add esp, 4
mov dword [esi + 0x50], eax
push ebp
push 1
lea ecx, [esi + 0x74]
mov byte [esp + 0x24], 2
call 0x41ff45
push ebp
push 1
lea ecx, [esi + 0x98]
mov byte [esp + 0x24], 3
call fcn.00413e35
mov edi, dword [0x432150]
push ebp
push 1
push 1
push ebp
mov dword [esi], 0x432ed0
call edi
push ebp
push ebp
push ebp
push ebp
mov dword [esi + 4], eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x2c]
lea ecx, [esi + 0xbc]
push eax
mov dword [esp + 0x20], 4
call fcn.00412525
lea ebp, [esi + 0x3bc]
push 0xffffffffffffffff
push 0
push 0xc
lea ecx, [ebp + 4]
mov byte [esp + 0x28], 5
mov dword [esp + 0x38], ebp
call fcn.0041e645
push 1
push 0x3e7
push 1
push 0
lea ecx, [ebp + 0x20]
mov byte [esp + 0x2c], 6
call fcn.00413765
lea eax, [ebp + 0x60]
push eax
mov dword [eax + 0x18], 0
call ebx
push 0
push 0
push 1
push 0
call edi
mov dword [ebp], eax
lea ebp, [esi + 0x438]
push 0
mov byte [esp + 0x20], 7
mov dword [esp + 0x30], ebp
lea ecx, [ebp + 4]
call fcn.0041ed95
push 1
push 0x3e7
push 1
push 0
lea ecx, [ebp + 0x20]
mov byte [esp + 0x2c], 8
call fcn.00413765
lea eax, [ebp + 0x60]
push eax
mov dword [eax + 0x18], 0
call ebx
push 0
push 0
push 1
push 0
call edi
mov ecx, dword [esp + 0x28]
push 0
push 0
push 1
mov dword [ebp], eax
push 0
mov dword [esi], 0x432ebc
mov dword [esi + 0xbc], 0x432e54
mov dword [esi + 0x4c4], ecx
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x4b4], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x4b8], eax
call edi
push 0
push 0
push 1
push 0
mov dword [esi + 0x4bc], eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x4c0], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x414b15
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4312e8
push eax
mov eax, dword [esp + 0x20]
mov dword fs:[0], esp
push ebx
push esi
push edi
mov edi, ecx
push eax
call fcn.00414c15
test al, al
jne 0x414b51
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x14
lea esi, [edi + 0x60]
push esi
mov dword [esp + 0x30], esi
call dword [0x4321ac]
inc dword [esi + 0x18]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x24], 0
call fcn.00414bb5
mov ecx, dword [esi + 0x18]
push esi
dec ecx
mov bl, al
mov dword [esi + 0x18], ecx
call dword [0x4321b0]
mov ecx, dword [esp + 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x14

Function at 0x41924a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431437
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.0041a64a
mov esi, dword [esp + 0x44]
mov ebx, 1
mov dword [esp + 0x38], ebx
xor edi, edi
mov eax, dword [esi + 4]
test eax, eax
je 0x41933b
cmp edi, dword [esi + 8]
jae 0x41933b
push 0x100
lea ecx, [esp + 0x1c]
call fcn.0041a64a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x2c]
push ecx
push edx
mov byte [esp + 0x44], 2
call fcn.0041a9ba
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 3
call fcn.0041a6aa
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], 2
call fcn.0041a6fa
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], bl
call fcn.0041a6fa
mov eax, dword [esi + 4]
test eax, eax
je 0x419304
cmp edi, dword [esi + 8]
jae 0x419304
xor ecx, ecx
mov cl, byte [eax + edi]
mov eax, ecx
jmp 0x419306
xor eax, eax
and eax, 0xff
lea ecx, [esp + 0x20]
push eax
call fcn.0041a64a
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x3c], 4
call fcn.0041a74a
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], bl
call fcn.0041a6fa
inc edi
jmp 0x419287
mov esi, dword [esp + 0x40]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0041a68a
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.0041a6fa
mov ecx, dword [esp + 0x30]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x419aaa
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 4]
mov esi, ecx
cmp eax, edi
je 0x419ac3
mov eax, dword [ebp + 8]
jmp 0x419ac5
xor eax, eax
add eax, 3
mov ecx, esi
shr eax, 2
mov dword [esi + 4], edi
mov dword [esi + 8], edi
lea eax, [eax + eax*2]
mov dword [esi], 0x432efc
push eax
call fcn.0041908a
xor ebx, ebx
mov dword [esi], 0x432f04
mov dword [esp + 0x10], edi
xor ecx, ecx
mov edx, dword [ebp + 4]
test edx, edx
je 0x419bb2
mov eax, dword [esp + 0x10]
cmp eax, dword [ebp + 8]
jae 0x419bb2
mov ebp, dword [esp + 0x10]
xor eax, eax
mov al, byte [edx + ebp]
cmp al, 0x41
jb 0x419b61
cmp al, 0x5a
ja 0x419b61
sub al, 0x41
cmp al, 0xff
je 0x419bb2
cmp al, 0xfe
je 0x419b52
and eax, 0x3f
add ecx, 6
shl ebx, 6
or eax, ebx
cmp ecx, 8
mov ebx, eax
jb 0x419b52
cmp edi, dword [esi + 8]
jae 0x419b9f
mov eax, dword [esi + 4]
add ecx, 0xfffffff8
mov edx, ebx
shr edx, cl
inc edi
cmp ecx, 8
mov byte [edi + eax - 1], dl
jae 0x419b39
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
jmp 0x419af0
cmp al, 0x61
jb 0x419b6d
cmp al, 0x7a
ja 0x419b6d
sub al, 0x47
jmp 0x419b1b
cmp al, 0x30
jb 0x419b79
cmp al, 0x39
ja 0x419b79
add al, 4
jmp 0x419b1b
cmp al, 0x2b
je 0x419b9b
cmp al, 0x2f
je 0x419b97
cmp al, 0x3d
je 0x419bb2
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
jmp 0x419af0
mov al, 0x3f
jmp 0x419b27
mov al, 0x3e
jmp 0x419b27
push 0
mov ecx, esi
call fcn.0041908a
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 8], edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x419c5a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x431577
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov al, byte [0x43d13c]
push ebx
xor ebx, ebx
push esi
test al, 1
mov dword [esp + 8], ebx
jne 0x419cc8
or al, 1
push 0x438744
mov byte [0x43d13c], al
lea eax, [esp + 0x28]
push eax
call fcn.004190ea
add esp, 8
push eax
mov ecx, 0x43d140
mov dword [esp + 0x3c], 1
call fcn.00419aaa
push 0x419d60
mov byte [esp + 0x3c], bl
mov dword [esp + 0x28], 0x432ef8
call fcn.00426889
add esp, 4
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00419aaa
push eax
push 0x43d140
mov dword [esp + 0x40], 2
call fcn.00419bca
push eax
lea ecx, [esp + 0x18]
call fcn.0041943a
mov esi, dword [esp + 0x40]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push eax
mov ecx, esi
mov byte [esp + 0x3c], 4
mov dword [esi], 0x432efc
call fcn.0041903a
mov dword [esp + 8], 1
mov dword [esp + 0xc], 0x432efc
push ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 5
call fcn.0041908a
mov dword [esp + 0xc], 0x432ef8
mov dword [esp + 0x18], 0x432efc
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 6
call fcn.0041908a
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x41ab1a
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4316e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.0041a64a
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.0041a3da
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 8]
mov esi, dword [esp + 0x34]
push eax
mov edx, dword [ecx]
lea ecx, [esp + 0x14]
mov eax, dword [esi]
push edx
push eax
mov byte [esp + 0x34], 2
call fcn.0041a43a
mov ecx, dword [esi + 4]
mov esi, dword [esp + 0x30]
lea edx, [esp + 8]
mov dword [esp + 0xc], ecx
push edx
mov ecx, esi
call fcn.0041a68a
mov dword [esp + 4], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call fcn.00419dea
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0041a6fa
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x41ae9a
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4317e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
mov dword [esp + 0x14], esi
call fcn.0041a64a
lea ebp, [esi + 8]
push 0
mov ecx, ebp
mov dword [esp + 0x30], 0
call fcn.0041a64a
lea edi, [esi + 0x10]
push 0
mov ecx, edi
mov byte [esp + 0x30], 1
call fcn.0041a64a
lea ebx, [esi + 0x18]
push 0
mov ecx, ebx
mov byte [esp + 0x30], 2
call fcn.0041a64a
push 0
lea ecx, [esi + 0x20]
mov byte [esp + 0x30], 3
call fcn.0041a64a
push 0
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 4
call fcn.0041a64a
mov eax, dword [esp + 0x34]
mov ecx, edi
push eax
mov byte [esp + 0x30], 5
call fcn.0041a6aa
push 1
lea ecx, [esp + 0x18]
mov dword [esi + 0x30], 0
call fcn.0041a64a
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 6
push ecx
mov ecx, esi
call fcn.0041a6aa
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.0041a6fa
mov edx, dword [esp + 0x34]
mov ecx, esi
push edx
call fcn.0041a5da
test eax, eax
jge 0x41af88
push esi
mov ecx, esi
call fcn.0041a74a
mov eax, dword [esi + 0x30]
mov ecx, esi
inc eax
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x34]
push eax
call fcn.0041a5da
test eax, eax
jl 0x41af69
push edi
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.0041a93a
push edi
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x44], 7
call fcn.0041abca
add esp, 0x18
push eax
mov ecx, ebp
mov byte [esp + 0x30], 8
call fcn.0041a6aa
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 7
call fcn.0041a6fa
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 5
call fcn.0041a6fa
push esi
lea eax, [esp + 0x18]
push edi
push eax
call fcn.0041abca
push eax
lea ecx, [esp + 0x2c]
push esi
push ecx
mov byte [esp + 0x44], 9
call fcn.0041a93a
add esp, 0x18
push eax
mov ecx, ebx
mov byte [esp + 0x30], 0xa
call fcn.0041a6aa
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 9
call fcn.0041a6fa
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.0041a6fa
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4

Function at 0x41b1ea
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431897
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x54]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.0041ae9a
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
push ecx
push edx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 1
call fcn.0041b0ba
mov dword [esp + 4], 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 6
call fcn.0041a6fa
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 5
call fcn.0041a6fa
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
call fcn.0041a6fa
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 3
call fcn.0041a6fa
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 2
call fcn.0041a6fa
lea ecx, [esp + 8]
mov byte [esp + 0x44], 0
call fcn.0041a6fa
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x41b39a
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x431928
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
mov ebp, ecx
push esi
mov esi, dword [ebp + 4]
mov dl, byte [esi + 8]
lea ecx, [esi + 8]
test dl, dl
lea eax, [ecx + 1]
je 0x41b3ce
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41b3c7
sub eax, ecx
dec eax
je 0x41b43f
mov dl, byte [esi + 0x808]
lea eax, [esi + 0x808]
test dl, dl
lea ecx, [eax + 1]
je 0x41b3ed
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x41b3e6
sub ecx, eax
dec ecx
je 0x41b43f
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004190ea
lea ecx, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x40], 0
call fcn.00419c5a
add esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41b424
mov ecx, dword [esp + 0x18]
cmp ecx, 0x1c
jae 0x41b453
mov dword [esp + 0x10], 0x432efc
mov dword [esp + 0x30], 3
push 0
lea ecx, [esp + 0x14]
call fcn.0041908a
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov edx, dword [eax + 0x18]
lea ebx, [eax + 0x18]
add edx, 0x1c
mov dword [esp + 0xc], eax
cmp ecx, edx
jae 0x41b476
mov dword [esp + 0x10], 0x432efc
mov dword [esp + 0x30], 4
jmp 0x41b434
cmp word [eax + 4], 1
je 0x41b48f
mov dword [esp + 0x10], 0x432efc
mov dword [esp + 0x30], 5
jmp 0x41b434
cmp word [eax + 2], 0
je 0x41b4a8
mov dword [esp + 0x10], 0x432efc
mov dword [esp + 0x30], 6
jmp 0x41b434
push edi
lea edx, [ebp + 0x10]
lea ecx, [eax + 8]
mov esi, 4
mov edi, dword [ecx]
add ecx, 4
mov dword [edx], edi
add edx, 4
dec esi
jne 0x41b4b4
mov ax, word [eax + 6]
mov word [ebp + 8], ax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41b4d9
push eax
call fcn.00425eba
add esp, 4
mov ecx, dword [ebx]
inc ecx
push ecx
call fcn.004266af
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
je 0x41b50e
mov ecx, dword [ebx]
mov edx, dword [esp + 0x10]
mov edi, eax
mov eax, ecx
lea esi, [edx + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
mov byte [ecx + edx], 0
mov dword [esp + 0x14], 0x432efc
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 7
call fcn.0041908a
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x401350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4afaa7
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x4d5784]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi], vtable.NKZ::CKZArchive.0
mov dword [esi + 4], vtable.NKZ::CKZArchive.1.0
mov dword [esi + 0xc], ebx
mov dword [esp + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x70], 7
mov dword [esi + 0x6c], ebx
xor eax, eax
mov word [esi + 0x5c], ax
xor ecx, ecx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov word [esi + 0x52], cx
mov byte [esi + 0x41], bl
mov byte [esi + 0x42], bl
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x49], eax
mov dword [esi + 0x4d], eax
xor edx, edx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov word [esi + 0x80], dx
mov word [esi + 0x54], ax
mov byte [esi + 0x40], bl
lea ecx, [esi + 0x88]
push ecx
mov byte [esp + 0x18], 4
call fcn.00403950
mov dword [esi + 0xa0], vtable.NKZ::CBuffer_unsigned_char_.0
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc4], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x404b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x16c
mov eax, dword [0x4d5784]
xor eax, esp
mov dword [esp + 0x168], eax
push ebx
push ebp
mov ebp, dword [esp + 0x178]
push edi
cmp esi, 0xffffffff
je 0x404cde
test ebp, ebp
je 0x404cde
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
xor ecx, ecx
push ecx
push ecx
push ecx
xor eax, eax
push eax
push esi
call edi
test eax, eax
jne 0x404b71
call fcn.00404d00
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0043039d
add esp, 0x16c
ret
push 0x40
lea eax, [esp + 0x134]
push 0
push eax
call fcn.00430560
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadFile]
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea edx, [esp + 0x13c]
push edx
push esi
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x404b54
cmp dword [esp + 0xc], 0x40
je 0x404bcf
mov eax, 0x80004005
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0043039d
add esp, 0x16c
ret
mov eax, dword [esp + 0x16c]
push 0
cdq
push 0
push edx
push eax
push esi
call edi
test eax, eax
je 0x404b54
push 0xf8
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00430560
add esp, 0xc
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xf8
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
test eax, eax
je 0x404b54
cmp dword [esp + 0xc], 0xf8
jne 0x404bb2
movzx eax, word [esp + 0x16]
dec eax
lea eax, [eax + eax*4]
push 1
add eax, eax
xor ecx, ecx
push ecx
add eax, eax
push ecx
add eax, eax
push eax
push esi
call edi
test eax, eax
je 0x404b54
xor eax, eax
push eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
lea eax, [esp + 0x10]
push eax
push 0x28
lea ecx, [esp + 0x114]
push ecx
push esi
call ebx
test eax, eax
je 0x404b54
cmp dword [esp + 0xc], 0x28
jne 0x404bb2
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x118]
add eax, edx
mov dword [ebp], eax
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0043039d
add esp, 0x16c
ret
mov ecx, dword [esp + 0x174]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x80070057
call fcn.0043039d
add esp, 0x16c
ret
Function at 0x404d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
je 0x404e28
cmp eax, ebx
je 0x404e28
cmp word [eax], bx
je 0x404e28
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x404d52
mov dword [ecx], ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d78
call fcn.00404d00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0x18]
push eax
push 4
push edi
push esi
mov dword [edi], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x404da9
call fcn.00404d00
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0x4d
jne 0x404e18
cmp byte [edi + 1], 0x5a
jne 0x404e18
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], ebx
call fcn.00404b10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404ddb
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x10]
xor eax, eax
push eax
push eax
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
test eax, eax
je 0x404d92
mov eax, dword [ebp + 8]
mov dword [edi], 0
test eax, eax
je 0x404dff
mov dword [eax], ebx
push 0
lea edx, [esp + 0x18]
push edx
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x404d92
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b0b0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x88
mov eax, dword [0x4d5784]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
push ebx
xor ebx, ebx
push ebp
xor ecx, ecx
mov dword [esp + 0x14], eax
xor eax, eax
push esi
push edi
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ebx
mov byte [esp + 0x8c], bl
mov dword [esp + 0x8d], eax
mov word [esp + 0x91], ax
mov byte [esp + 0x93], al
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jmp 0x40b154
mov ecx, dword [esp + 0x40]
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov esi, ecx
and esi, 0x3f
cmp ebp, ebx
jbe 0x40b19a
jmp 0x40b170
mov cl, byte [edi]
mov byte [esp + esi + 0x48], cl
inc esi
inc edi
add dword [esp + 0x40], 1
adc dword [esp + 0x44], ebx
dec ebp
cmp esi, 0x40
jne 0x40b192
lea edx, [esp + 0x20]
xor esi, esi
call fcn.00410570
cmp ebp, ebx
ja 0x40b170
mov ecx, dword [esp + 0x40]
and ecx, 0x3f
mov ebp, 8
lea edi, [esp + 0x8c]
mov esi, ecx
jmp 0x40b1b0
mov dl, byte [edi]
mov byte [esp + esi + 0x48], dl
inc esi
inc edi
add dword [esp + 0x40], 1
adc dword [esp + 0x44], ebx
dec ebp
cmp esi, 0x40
jne 0x40b1d2
lea edx, [esp + 0x20]
xor esi, esi
call fcn.00410570
cmp ebp, ebx
ja 0x40b1b0
xor eax, eax
jmp 0x40b1e0
add byte [esp + eax + 0x8c], 1
jne 0x40b1f0
inc eax
cmp eax, 8
jl 0x40b1e0
add dword [esp + 0x10], 1
adc dword [esp + 0x14], ebx
jne 0x40b209
cmp dword [esp + 0x10], 0x80000
jb 0x40b150
mov eax, dword [esp + 0x1c]
lea edi, [esp + 0x20]
call fcn.00410630
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043039d
add esp, 0x88
ret 0xc
Function at 0x415370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4af631
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push edi
mov eax, dword [0x4d5784]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [edi + 0x2c], ebx
mov dword [esp + 0x18], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov eax, dword [esp + 0x24]
mov byte [esp + 0x18], 2
mov dword [edi + 0xc], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], eax
mov dword [edi + 0x10], ebx
cmp dword [edi + 0x30], esi
je 0x4153e2
cmp esi, ebx
je 0x4153d0
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov eax, dword [edi + 0x30]
cmp eax, ebx
je 0x4153df
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 0x30], esi
cmp dword [edi + 0x2c], ebp
je 0x415406
cmp ebp, ebx
je 0x4153f4
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
push ebp
call ecx
mov eax, dword [edi + 0x2c]
cmp eax, ebx
je 0x415403
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [edi + 0x2c], ebp
mov eax, dword [edi + 0x14]
sub eax, 1
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ebx
mov byte [edi + 8], bl
je 0x415435
sub eax, 1
jne 0x41543a
mov ecx, edi
call fcn.00415700
jmp 0x41543a
call fcn.00415600
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0xc
ret 0x10