joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b465
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0049b3e1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x49b5d4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x49b5d4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x49b589
jg 0x49b4c1
test eax, eax
je 0x49b57f
push 1
push 0x1000
call fcn.0048fe16
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x49b4e4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x49b576
push 0x8000
push ebx
call fcn.0048a1ce
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x49b50d
jg 0x49b508
cmp ecx, 0x1000
jb 0x49b50d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0048d5bd
add esp, 0x10
cmp eax, 0xffffffff
je 0x49b552
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x49b508
jl 0x49b539
test ecx, ecx
jne 0x49b4fa
push dword [ebp - 0xc]
push ebx
call fcn.0048a1ce
push esi
call fcn.0048de0a
add esp, 0xc
xor ebx, ebx
jmp 0x49b5e2
cmp byte [edi + 0x24], 0
je 0x49b569
cmp dword [edi + 0x20], 5
jne 0x49b569
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x49b574
mov ebx, dword [edi + 0x18]
jmp 0x49b576
xor ebx, ebx
push esi
call fcn.0048de0a
pop ecx
jmp 0x49b5e2
test ecx, ecx
jg 0x49b54b
jl 0x49b589
test eax, eax
jae 0x49b54b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00490a17
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x49b5a9
cmp byte [edi + 0x1c], 0
je 0x49b54b
jmp 0x49b5da
push ebx
call fcn.00491eff
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x49b54b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x49b5e2
cmp byte [edi + 0x1c], 0
je 0x49b5df
mov ebx, dword [edi + 0x18]
jmp 0x49b5e2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00490a17
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x49c730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49c75d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49c75d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401851
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dh, byte [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov esi, ebx
push edi
test dh, 1
je 0x401893
mov al, byte [ebp + 8]
test esi, esi
je 0x401891
mov edi, esi
mov dh, al
mov dl, dh
add dl, dl
mov al, dl
xor al, 0x1b
test dh, dh
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
mov dh, cl
sub edi, 1
jne 0x40186f
mov byte [ebp - 1], dh
mov al, cl
mov dh, byte [ebp + 0xc]
xor bl, al
shr dh, 1
inc esi
mov byte [ebp + 0xc], dh
cmp esi, 8
jl 0x40185f
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x40197f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, ecx
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax]
push edi
mov dword [ebp - 4], edx
xor edi, edi
test eax, eax
jle 0x4019b8
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [ecx + edi], al
inc edi
mov eax, dword [edx]
cmp edi, eax
jl 0x4019a4
mov edx, dword [ebp - 4]
inc edx
add esi, 4
mov dword [ebp - 4], edx
cmp edx, 4
jl 0x401996
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401be1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x401c0a
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x401bfa
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x401c0e
Capabilities:
Encode data using base64

Disassembly:
push 0x64
mov eax, 0xd4f066
call fcn.00d286ca
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
xor ebx, ebx
mov dword [ebp - 0x70], esi
push 0x41
push ebx
push eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], ebx
call fcn.00d2a220
add esp, 0xc
mov ecx, ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x54], al
inc ecx
cmp ecx, 0x1a
jl 0x401c39
mov ecx, ebx
lea eax, [ecx + 0x61]
mov byte [ebp + ecx - 0x3a], al
inc ecx
cmp ecx, 0x1a
jl 0x401c48
mov ecx, ebx
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 0xa
jl 0x401c57
mov edi, esi
mov word [ebp - 0x16], 0x2f2b
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov byte [esi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6c], 1
test eax, eax
je 0x401dc3
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x58], al
inc edi
mov dl, byte [ebp - 0x57]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x56]
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x5f], ch
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], cl
cmp edi, esi
jne 0x401d1b
mov esi, dword [ebp - 0x64]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x5c], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x5b], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ch, 0x3f
mov byte [ebp - 0x5a], cl
mov byte [ebp - 0x59], ch
movzx eax, byte [ebp + edi - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.004054e5
inc edi
cmp edi, 4
jl 0x401cf5
mov dl, byte [ebp - 0x5d]
mov edi, ebx
mov cl, byte [ebp - 0x5e]
mov ch, byte [ebp - 0x5f]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x401c98
mov dword [ebp - 0x68], edi
test edi, edi
je 0x401dc0
mov eax, edi
cmp edi, esi
jge 0x401d51
cmp eax, esi
jae 0x401dcd
mov byte [ebp + eax - 0x58], bl
inc eax
cmp eax, esi
jl 0x401d39
mov ch, byte [ebp - 0x56]
mov dl, byte [ebp - 0x57]
mov cl, byte [ebp - 0x58]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x5c], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x5b], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x59], ch
lea eax, [edi + 1]
mov byte [ebp - 0x5a], dl
mov dword [ebp - 0x58], eax
test eax, eax
jle 0x401dab
mov esi, dword [ebp - 0x64]
mov edi, eax
movzx eax, byte [ebp + ebx - 0x5c]
mov ecx, esi
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.004054e5
inc ebx
cmp ebx, edi
jl 0x401d8e
mov edi, dword [ebp - 0x68]
push 3
pop esi
cmp edi, esi
jge 0x401dc0
sub esi, edi
mov ecx, dword [ebp - 0x64]
push 0x3d
call fcn.004054e5
sub esi, 1
jne 0x401db1
mov esi, dword [ebp - 0x64]
mov eax, esi
call fcn.00d28679
ret 0xc
call fcn.00d28084
int3
Function at 0x54c6e9
Capabilities:
Get disk information via ioctl

Disassembly:
push 0x70
mov eax, 0xd4f468
call fcn.00d286ca
mov esi, ecx
mov dword [ebp - 0x60], esi
xor eax, eax
lea edi, [ebp - 0x44]
stosd dword es:[edi], eax
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], cl
mov dword [ebp - 4], ecx
call dword [esi + 0xc]
mov bl, 0x41
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x58], bl
xor edi, edi
xor edx, edx
mov eax, edi
mov ecx, edi
shr eax, 5
and ecx, 0x1f
inc edx
shl edx, cl
test dword [ebp + eax*4 - 0x14], edx
je 0x54c84d
push 0xd5b9d0
lea ecx, [ebp - 0x7c]
call fcn.0045a3f7
push dword [ebp - 0x58]
mov ecx, eax
mov byte [ebp - 4], 1
push 1
push 0
call fcn.0054cf04
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040546b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
cmova eax, dword [ebp - 0x2c]
push eax
call dword [esi + 0x10]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.004054bf
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0
call fcn.004054bf
cmp esi, 3
jne 0x54c84a
push str.._
lea ecx, [ebp - 0x2c]
call fcn.0045a3f7
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004054e5
push 1
push 0xd5b9dc
lea ecx, [ebp - 0x2c]
call fcn.0054ccbd
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
cmova eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
push ecx
push esi
push ecx
push esi
mov esi, dword [ebp - 0x60]
push ecx
push eax
call dword [esi + 0x18]
mov dword [ebp - 0x64], eax
cmp eax, 0xffffffff
je 0x54c83c
xor edx, edx
lea ecx, [ebp - 0x48]
push edx
push ecx
push 0xc
lea ecx, [ebp - 0x54]
push ecx
push edx
push edx
push 0x2d1080
push eax
call dword [esi + 8]
push dword [ebp - 0x64]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [ebp - 0x50]
mov dword [ebp - 0x5c], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x5c]
cmp eax, 0xffffffff
je 0x54c83c
lea ecx, [ebp - 0x44]
push ecx
push eax
mov ecx, esi
call fcn.0054a5c2
test eax, eax
jne 0x54c83c
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.0043296e
mov ecx, esi
call fcn.0053ac27
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.004054bf
jmp 0x54c84d
mov esi, dword [ebp - 0x60]
inc bl
inc edi
mov byte [ebp - 0x58], bl
cmp bl, 0x5a
jle 0x54c722
lea ecx, [ebp - 0x44]
call fcn.004054bf
call fcn.00d28679
ret
Function at 0x54d8e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], eax
sar eax, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
cmp edx, eax
jge 0x54d94e
lea esi, [edi + edi]
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.0054d891
imul ecx, dword [ebp - 8], 0x18
movzx edi, al
xor edi, 1
inc edi
add edi, esi
imul eax, edi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.00461109
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], edi
cmp edi, eax
jl 0x54d912
mov ecx, dword [ebp - 0x18]
mov esi, edi
cmp edi, eax
jne 0x54d96f
test cl, 1
jne 0x54d96f
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.00461109
mov esi, dword [ebp - 4]
cmp dword [ebp - 0xc], esi
jge 0x54d9a2
push dword [ebp - 0x10]
lea edi, [esi - 1]
sar edi, 1
imul eax, edi, 0x18
add eax, ebx
push eax
mov dword [ebp - 4], eax
call fcn.0054d891
test al, al
je 0x54d9a2
push dword [ebp - 4]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.00461109
mov esi, edi
cmp dword [ebp - 0xc], edi
jl 0x54d974
push dword [ebp - 0x10]
imul ecx, esi, 0x18
add ecx, ebx
call fcn.00461109
pop edi
pop esi
pop ebx
leave
ret

Function at 0x568650
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x11
call ebx
movzx esi, ax
shr esi, 7
push 0x12
and esi, 1
call ebx
mov edi, esi
or edi, 2
test al, 0x80
push 0x10
cmove edi, esi
call ebx
mov esi, edi
or esi, 4
test al, 0x80
push 0x5b
cmove esi, edi
call ebx
mov edi, esi
or edi, 8
test al, 0x80
push 0x5c
cmove edi, esi
call ebx
mov ecx, edi
or ecx, 8
test al, 0x80
cmove ecx, edi
pop edi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x5691b7
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xorps xmm0, xmm0
ucomisd xmm1, xmm0
lahf
test ah, 0x44
jnp 0x5691cc
movaps xmm0, xmm1
movsd qword [ebp - 8], xmm0
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [ebp + ecx - 8]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0x5691d8
mov eax, edx
leave
ret
Function at 0x56b468
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x14]
xor eax, eax
mov dword [ebp - 4], ecx
push eax
push dword [ebp + 0x10]
mov ebx, edx
push eax
push eax
call fcn.0051f73e
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.00d30269
mov esi, eax
mov edx, str.char__
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
inc esi
mov ecx, esi
call fcn.005648bc
push dword [ebp + 0x14]
mov edi, eax
push 0
push dword [ebp + 0x10]
push esi
push edi
call fcn.00563df9
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [ebp - 4]
push str._libui___hs:_hs:_hs____hs_hs_n
call fcn.0056eb33
add esp, 0x48
mov ecx, edi
mov esi, eax
call fcn.005649e2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, esi
call fcn.005649e2
call dword [sym.imp.KERNEL32.dll_DebugBreak]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5bf6a3
Capabilities:
Hash data with md5

Disassembly:
and dword [ecx + 0x14], 0
and dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0xc5bbe3
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0xd5036f
call fcn.00d28697
mov ebx, edx
mov dword [ebp - 0x10], ecx
push 1
call fcn.00d2815f
mov edi, eax
push 0x64
mov byte [edi], 0
call fcn.00d2815f
mov esi, eax
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
push 0x64
push 0
push esi
call fcn.00d2a220
add esp, 0x14
mov ecx, esi
push ebx
push edi
push dword [ebp - 0x10]
call fcn.004056f4
xor ecx, ecx
push ecx
push ecx
push eax
push 0xc5bc41
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00d28665
ret

Function at 0xc5bdc5
Capabilities:
Hash data using sha1

Disassembly:
push 4
mov eax, 0xd503d0
call fcn.00d28697
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
mov dword [ebp - 4], eax
push eax
push 0xd5b9ca
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
call fcn.004329d3
mov eax, esi
call fcn.00d28665
ret
Function at 0xcdec50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
push str.kernel32
mov esi, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0xcdec74
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0xd5cd90
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push 0xd5cdc4
push esi
mov dword [ebp - 8], ebx
call fcn.00d3ab76
add esp, 8
test eax, eax
je 0xcdecbc
test ebx, ebx
je 0xcdecac
push 8
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0xcdece5
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xcdece5
push 0x800
push 0
push esi
call ebx
pop ebx
mov edi, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0xcdeda8
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcded01
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0xd93dd4]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0xcded9e
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0xcded9e
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcded40
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcded60
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0xcded75
mov eax, dword [ebp - 8]
test eax, eax
je 0xcded95
push 8
push 0
push ebx
call eax
jmp 0xcded9c
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0xd93ddc]
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xcdf410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
call fcn.00ce0a40
mov edx, edi
mov dword [ebp - 0x14], eax
call fcn.00ce0a20
mov edx, dword [ebp + 8]
mov cl, 1
mov byte [ebp - 1], cl
mov dword [edx], 0
test eax, eax
je 0xcdf53b
cmp byte [eax + 0x3c], 0
je 0xcdf53b
mov esi, dword [edi + 0x8d0]
test esi, esi
je 0xcdf53b
mov eax, dword [edi + 0x78]
test eax, eax
je 0xcdf46c
test byte [eax + 4], 0x10
je 0xcdf46c
add eax, 0x78
jmp 0xcdf472
lea eax, [edi + 0x8d4]
mov edi, dword [edi + 0x4a4]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
test edi, edi
je 0xcdf53a
nop dword [eax]
cmp dword [esi + 0xc], 0
je 0xcdf52b
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi]
mov eax, dword [ecx + 8]
mov ecx, dword [eax + 8]
call fcn.00cef880
test eax, eax
je 0xcdf52b
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 4]
mov edi, dword [ecx + 0xc]
cmp byte [edi + 0x1c9], 0
jne 0xcdf4c6
test edx, edx
je 0xcdf4d9
jmp 0xcdf528
test edx, edx
je 0xcdf528
mov ecx, dword [edi + 0x64]
call fcn.00cef880
test eax, eax
je 0xcdf528
mov ecx, dword [ebp - 0xc]
cmp byte [edi + 0x1ca], 0
jne 0xcdf4ea
cmp dword [esi + 0x1c], 0xffffffff
je 0xcdf4fa
jmp 0xcdf528
mov eax, dword [esi + 0x1c]
cmp eax, 0xffffffff
je 0xcdf528
cmp dword [edi + 0x440], eax
jne 0xcdf528
mov eax, dword [ecx + 8]
mov eax, dword [eax + 0x30]
cmp eax, dword [esi + 0x18]
jne 0xcdf528
mov ecx, dword [edi + 0x1e0]
mov edx, dword [esi + 8]
mov ecx, dword [ecx]
call fcn.00cef880
test eax, eax
je 0xcdf528
mov ecx, dword [ebp - 0x14]
lea edx, [esi + 0x20]
call fcn.00cdeea0
test al, al
jne 0xcdf543
mov edi, dword [ebp - 8]
inc ebx
add esi, 0x60
cmp ebx, edi
jb 0xcdf490
mov cl, byte [ebp - 1]
pop ebx
pop edi
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
pop ebx
pop edi
inc dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
xor cl, cl
mov al, cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xce41e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.00405640
push eax
push edx
push esi
call fcn.00d48929
add esp, 0xc
pop esi
pop ebp
ret

Function at 0xce5b90
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + edx]
mov edx, 0x1505
cmp esi, edi
jae 0xce5bb8
mov cl, byte [esi]
call fcn.00cef810
movsx ecx, al
inc esi
mov eax, edx
shl eax, 5
add edx, eax
xor edx, ecx
cmp esi, edi
jb 0xce5ba0
pop edi
movzx eax, dl
pop esi
ret

Function at 0xcedd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x6cb], 0
je 0xcedde0
cmp dword [esi + 0x1a4], 0
je 0xcedda0
push ebx
call fcn.00ce3dd0
mov dl, 1
mov bl, al
call fcn.00ce3db0
push dword [esi + 0x154]
mov eax, dword [esi + 0x1a4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push esi
call eax
add esp, 0x14
mov dl, bl
mov ecx, esi
pop ebx
pop edi
pop esi
pop ebp
jmp fcn.00ce3db0
mov eax, edi
sub eax, 0
je 0xceddb1
sub eax, 1
je 0xceddb1
sub eax, 1
jne 0xcedde0
push dword [esi + 0x150]
lea eax, [edi*2 + 0xd5a4a4]
push 1
add eax, edi
push 2
push eax
call fcn.00d3a4ac
push dword [esi + 0x150]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00d3a4ac
add esp, 0x20
pop edi
pop esi
pop ebp
ret

Function at 0xcefa50
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
push edi
mov esi, edx
mov edi, ecx
push esi
push 0
push edi
call fcn.00d2a220
add esp, 0xc
push 2
push esi
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
neg eax
pop edi
sbb eax, eax
and eax, 2
pop esi
ret
Function at 0xcf4700
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 0
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 4
mov dword [ebp + 0xc], esi
call fcn.00d2a220
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xcf47d1
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0xcf47b3
push 0
push edi
push dword [ebp - 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0xcf47b3
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x14]
push 0
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call edi
test eax, eax
je 0xcf47b3
cmp esi, dword [ebp - 0xc]
jb 0xcf47b3
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0xcf47c1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0xcf47d1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov esp, ebp
pop ebp
ret