joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427060
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
add ebp, 0xffffffff
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x4270c7
push 0x2d
push 0x5026a8
push 0x6e
push 0x79
push 4
call fcn.00415990
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00487e85
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x4270f5
push 0x33
push 0x5026a8
push 0x78
push 0x79
push 4
call fcn.00415990
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00487e85
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.004124d0
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.00421590
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.0048a180
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.0048fe00
push 0x14
push esi
call fcn.0041be20
add esp, 0x38
test eax, eax
jle 0x427187
push 0x48
add ebp, 0xffffffec
push 0x5026a8
push ebp
call fcn.004136c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x14], ebx
jne 0x42719c
push 0x4b
push 0x5026a8
push 0x41
push 0x79
push 4
call fcn.00415990
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00487e85
add esp, 0x20
ret
call fcn.004124d0
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.00426f00
add esp, 0x14
test eax, eax
jl 0x427187
test ebp, ebp
jle 0x4271cd
mov ecx, ebx
mov eax, edi
sub ecx, edi
mov edx, ebp
nop
mov bl, byte [ecx + eax]
xor byte [eax], bl
add eax, 1
sub edx, 1
jne 0x4271c0
call fcn.004124d0
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.00426f00
add esp, 0x14
test eax, eax
jl 0x427187
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x427211
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00413870
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00487e85
add esp, 0x20
ret
Function at 0x429870
Capabilities:
Encode data using xor

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.004275d0
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x20], esi
jge 0x4298d3
xor eax, eax
jmp 0x429a61
lea ecx, [esp + 0x2c]
push ecx
call fcn.0043cd20
mov edx, dword [esp + 0x160]
add esp, 4
test edi, edi
mov dword [esp + 0x18], edx
jne 0x4298f8
mov dword [esp + 0x148], edi
jmp 0x429924
cmp dword [esp + 0x148], 0xffffffff
jne 0x429924
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x429910
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x429910
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x429a4f
jmp 0x429938
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x42993e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.0043ca50
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0043cc60
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.0043cc60
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.0043cc70
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.0048fe00
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x429a38
add eax, 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x4299e0
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.0043ce00
add esp, 0x1c
test esi, esi
jle 0x429a31
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub edi, 1
jne 0x429a20
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x4299e0
mov eax, dword [esp + 0x18]
sub eax, esi
add ebx, 1
add ebp, esi
test eax, eax
mov dword [esp + 0x18], eax
jne 0x429930
lea eax, [esp + 0x2c]
push eax
call fcn.0043cdc0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00487e85
add esp, 0x130
ret
Function at 0x431620
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4316f0
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x431641
cmp al, 0x6b
jne 0x4316f0
cmp al, 0x6b
lea edx, [ecx + 1]
jne 0x4316b1
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x431665
mov al, byte [edx]
add edx, 1
cmp al, 0xba
je 0x431665
cmp al, 0xbb
jne 0x43168e
add ecx, 1
cmp ecx, esi
jl 0x431651
sub esi, ecx
test ecx, ecx
jne 0x4316b4
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00415990
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00415990
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4316dd
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00415990
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0048fe00
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00415990
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x43ca50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
test ebp, ebp
push edi
mov dword [esp + 0x14], ecx
je 0x43ca9f
mov eax, 1
mov dword [esi], ebp
jmp 0x43caa1
mov ebp, dword [esi]
test ecx, ecx
je 0x43cb84
push ebp
call fcn.004275c0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x43cad0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.00414850
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x43cb27
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.00421110
add esp, 0xc
test eax, eax
je 0x43cc34
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.004212c0
add esp, 0xc
test eax, eax
je 0x43cc34
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.004212d0
add esp, 0xc
test eax, eax
je 0x43cc34
jmp 0x43cb61
cmp edi, 0x80
jbe 0x43cb43
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.00414850
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.0048fe00
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x43cb8c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.0048a180
add esp, 0xc
jmp 0x43cb8c
test eax, eax
je 0x43cc20
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x43cb90
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.00421110
add esp, 0xc
test eax, eax
je 0x43cc34
push ebp
call fcn.004275c0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.004212c0
add esp, 0x10
test eax, eax
je 0x43cc34
xor eax, eax
jmp 0x43cbe0
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x43cbe0
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.00421110
add esp, 0xc
test eax, eax
je 0x43cc34
push ebp
call fcn.004275c0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.004212c0
add esp, 0x10
test eax, eax
je 0x43cc34
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.00421430
add esp, 8
test eax, eax
jne 0x43cc38
xor eax, eax
jmp 0x43cc3d
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00487e85
add esp, 0x8c
ret
Function at 0x455d50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x455d69
mov esi, edi
mov edi, eax
jmp 0x455d6b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x455d7b
mov eax, ebx
jmp 0x455d85
push eax
push ebx
call fcn.00411150
add esp, 8
test eax, eax
jne 0x455d8d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x455dab
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x455d94
cmp eax, dword [esi + 4]
jge 0x455dc2
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x455db0
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x455de5
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x455de2
sub eax, 1
test eax, eax
jg 0x455dd2
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x45a0d0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x45a1c0
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x45a152
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x50f1a8]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x50f1a8]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x50f1a8]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + 0x50f1a8]
mov byte [ecx], dl
jmp 0x45a1ab
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x45a164
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x50f1a8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x50f1a8]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x45a196
lea edx, [edi + 0x3c]
jmp 0x45a1a3
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x50f1a8]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x45a0f0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x45ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
mov ebx, edi
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
dec dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x45ce43
mov ecx, dword [edi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45ceb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], eax
lea ebx, [edi + 0x44]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [ebx]
lea ebx, [ebx - 4]
mov ecx, eax
mov dword [ebp - 0xc], eax
movzx esi, al
shr ecx, 8
movzx edx, cl
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
and eax, 0xff
mov eax, dword [edi + eax*4 + 0x48]
add eax, dword [edi + ecx*4 + 0x448]
xor eax, dword [edi + edx*4 + 0x848]
add eax, dword [edi + esi*4 + 0xc48]
xor eax, dword [ebp - 4]
dec dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jne 0x45ced4
mov ecx, dword [edi]
xor ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [edi + 4]
xor ecx, eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45cf40
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0x12
push esi
push edi
mov ecx, 0x400
mov dword [ebp - 0x10], ebx
lea edi, [ebx + 0x48]
mov esi, 0x50fc10
rep movsd dword es:[edi], dword [esi]
mov eax, 0x510c10
xor esi, esi
sub eax, ebx
mov edi, ebx
mov ebx, eax
movzx eax, byte [esi + edx]
lea edi, [edi + 4]
inc esi
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
shl ecx, 8
movzx eax, byte [esi + edx]
inc esi
or eax, ecx
xor ecx, ecx
cmp esi, dword [ebp + 8]
cmovge esi, ecx
shl eax, 8
movzx ecx, byte [esi + edx]
inc esi
or ecx, eax
xor eax, eax
cmp esi, dword [ebp + 8]
cmovge esi, eax
mov eax, dword [ebx + edi - 4]
xor eax, ecx
dec dword [ebp - 8]
mov dword [edi - 4], eax
jne 0x45cf71
mov ebx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.0045ce20
mov eax, dword [ebp - 4]
add esp, 4
mov dword [ebx + esi*4], eax
mov eax, dword [ebp - 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x45cfd8
lea esi, [ebx + 0x4c]
mov dword [ebp - 0xc], 4
jmp 0x45d010
mov edi, 0x80
lea eax, [ebp - 8]
mov ecx, ebx
push eax
lea edx, [ebp - 4]
call fcn.0045ce20
mov eax, dword [ebp - 4]
add esp, 4
mov dword [esi - 4], eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
add esi, 8
dec edi
jne 0x45d015
dec dword [ebp - 0xc]
jne 0x45d010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45e9d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x45e9e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x45ea24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x45ea20
lea ebx, [ebx]
cmp esi, edx
jae 0x45ea24
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x45ea10
cmp esi, edx
jb 0x45ea29
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x45f630
Capabilities:
Create thread

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 1
je 0x45f640
cmp eax, 5
je 0x45f640
xor al, al
ret
push 0
push 0
push ecx
push 0x45f520
push 0
push 0
mov dword [ecx + 4], 2
call fcn.00488e53
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
ret
Function at 0x462550
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d0dab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x201c
call fcn.0048af60
mov eax, dword [0x51e710]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
push esi
push edi
mov eax, dword [0x51e710]
xor eax, esp
push eax
lea eax, [esp + 0x2030]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x20]
push eax
push 0x2000
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
jne 0x4625ba
or eax, 0xffffffff
jmp 0x46269a
mov esi, dword [esp + 0x20]
xor ebx, ebx
shr esi, 2
xor edi, edi
mov dword [esp + 0x14], esi
test esi, esi
je 0x462698
mov eax, esi
mov esi, dword [esp + edi*4 + 0x24]
test esi, esi
je 0x46268f
call fcn.00473e96
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x4626c0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov edx, esi
mov dword [esp + 0x2038], 0
lea ecx, [esp + 0x1c]
call fcn.00466180
cmp eax, 1
jne 0x462662
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.004626d0
add esi, 0xfffffff0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2038], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x462654
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0x1c], 1
mov eax, dword [esp + 0x14]
jne 0x46268f
inc ebx
jmp 0x46268f
mov dword [esp + 0x2038], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46268b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jb 0x4625d3
mov eax, ebx
mov ecx, dword [esp + 0x2030]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.00487e85
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0045f320
int3

Function at 0x4629b0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push ecx
push 0
mov edi, 1
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4629e5
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, edi
mov eax, 2
pop esi
cmove edi, eax
mov eax, edi
pop edi
pop ebx
ret

Function at 0x462c70
Capabilities:
Create thread

Disassembly:
mov eax, dword [ecx + 4]
cmp eax, 1
je 0x462c7d
cmp eax, 5
jne 0x462ca1
push 0
push 0
push ecx
push 0x462b60
push 0
push 0
mov dword [ecx + 4], 2
call fcn.00488e53
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
ret
Function at 0x4c4a84
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
sub esp, 0x18
mov ecx, dword fs:[0x30]
invalid
push ecx

Function at 0x4c4c80
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
or eax, 0x51e444
mov dword [esp], eax
mov edx, dword [eax + 4]
cmp ecx, 8
jbe 0x4c4cb1
mov ecx, eax
mov eax, 8
mov edi, dword [ecx + eax]
add edi, edx
mov dword [esi + eax], edi
mov edi, dword [0x51e468]
add eax, edi
mov edi, dword [0x51e444]
cmp eax, edi
jb 0x4c4c97
mov eax, dword [0x51e464]
push ebp
mov dword [esi + 8], eax
push dword [esp + 8]
mov edx, dword [0x51e444]
push edx
push esi
call ebx
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x51e460]
add ecx, eax
mov edx, dword [0x51e460]
add esi, edx
push esi
call ecx
add esp, 4
jmp 0x4c4c36

Function at 0x4c7aa0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0x10325476
mov ecx, 4
shl ecx, 2
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0xc3d2e1f0
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x14], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x14], 0
pop ebp
ret
Function at 0x405dbf
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
push edi
xor edi, edi
cmp edx, dword [ebp + 0xc]
cmova esi, eax
test esi, esi
je 0x405def
movzx eax, byte [edx]
xor eax, dword [ecx]
imul eax, eax, 0x1000193
inc edx
inc edi
mov dword [ecx], eax
cmp edi, esi
jne 0x405dda
jmp 0x405df1
mov eax, dword [ecx]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4078a7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4078c9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407985
jmp 0x407980
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x4078ea
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4078ec
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x407974
jg 0x4078ff
test esi, esi
je 0x407974
test ecx, ecx
jl 0x407941
jg 0x407909
test eax, eax
je 0x407941
cmp ebx, ecx
jg 0x40791b
jl 0x407913
cmp esi, eax
jae 0x40791b
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.007390e0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x407947
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x407974
jg 0x407951
test esi, esi
je 0x407974
cmp dword [edi + 0x4c], 0
je 0x407974
mov ecx, edi
call fcn.004065a3
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.00742b27
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x40d786
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 5
mov ebx, eax
xor edi, edi
cmp byte [ebp + 8], 0
pop eax
cmovne edi, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret