joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d890
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x443151
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004094f0
mov eax, dword [esp + 0x344]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x340], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0x14]
call fcn.0040b230
lea ecx, [esp + 0x154]
call fcn.004231f0
mov ebx, 1
lea ecx, [esp + 0x154]
mov byte [esp + 0x33c], bl
call fcn.00423240
test al, al
je 0x40d91e
push 0
lea ecx, [esp + 0x10]
call fcn.00409f10
push eax
call fcn.0040ecf0
add esp, 8
jmp 0x40d992
lea ecx, [esp + 0xc]
call fcn.00409640
test eax, eax
jle 0x40d980
lea ecx, [esp + 0x1ec]
call fcn.004094f0
lea ecx, [esp + 0x1ec]
lea edx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x344], 2
call fcn.0040c3f0
add esp, 8
lea ecx, [esp + 0x1ec]
push 0
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x1ec]
mov edi, eax
mov byte [esp + 0x33c], bl
call fcn.00409580
jmp 0x40d994
push 0
lea ecx, [esp + 0x10]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
test edi, edi
jne 0x40d9c0
mov esi, dword [esp + 0x348]
test esi, esi
je 0x40d9be
mov eax, dword [esi]
push ebx
push str.createDirWin32
mov ecx, esi
call dword [eax + 0x24]
mov ecx, esi
call fcn.0041d0e0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x28]
test edi, edi
lea ecx, [esp + 0x154]
mov byte [esp + 0x33c], 0
setne bl
call fcn.00423230
lea ecx, [esp + 0xc]
mov dword [esp + 0x33c], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x334]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x334
ret

Function at 0x40da10
Capabilities:
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x443181
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebx
push esi
lea ecx, [esp + 8]
call fcn.004094f0
mov eax, dword [esp + 0x340]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x33c], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b230
lea ecx, [esp + 0x150]
call fcn.004231f0
mov bl, 1
lea ecx, [esp + 0x150]
mov byte [esp + 0x338], bl
call fcn.00423240
test al, al
lea ecx, [esp + 8]
je 0x40da96
call fcn.00409f10
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40db02
call fcn.00409640
test eax, eax
jle 0x40daf2
lea ecx, [esp + 0x1e8]
call fcn.004094f0
lea ecx, [esp + 0x1e8]
lea edx, [esp + 8]
push ecx
push edx
mov byte [esp + 0x340], 2
call fcn.0040c3f0
add esp, 8
lea ecx, [esp + 0x1e8]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [esp + 0x1e8]
mov esi, eax
mov byte [esp + 0x338], bl
call fcn.00409580
jmp 0x40db04
lea ecx, [esp + 8]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x150]
mov byte [esp + 0x338], 0
setne bl
call fcn.00423230
lea ecx, [esp + 8]
mov dword [esp + 0x338], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x330]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x334
ret
Function at 0x40dbb0
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4431b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebx
push esi
lea ecx, [esp + 8]
call fcn.004094f0
mov eax, dword [esp + 0x340]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x33c], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
call fcn.0040b230
mov ebx, 1
push 0
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.0040c740
add esp, 0xc
lea ecx, [esp + 0x150]
call fcn.004231f0
lea ecx, [esp + 0x150]
mov byte [esp + 0x338], bl
call fcn.00423240
test al, al
je 0x40dc5b
mov edx, dword [esp + 0x344]
lea ecx, [esp + 8]
push edx
call fcn.00409f10
push eax
call fcn.0040ed10
add esp, 8
and eax, 0xff
jmp 0x40dcdb
lea ecx, [esp + 8]
call fcn.00409640
test eax, eax
jle 0x40dcc3
lea ecx, [esp + 0x1e8]
call fcn.004094f0
lea eax, [esp + 0x1e8]
lea ecx, [esp + 8]
push eax
push ecx
mov byte [esp + 0x340], 2
call fcn.0040c3f0
mov edx, dword [esp + 0x34c]
add esp, 8
lea ecx, [esp + 0x1e8]
push edx
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x1e8]
mov esi, eax
mov byte [esp + 0x338], bl
call fcn.00409580
jmp 0x40dcdd
mov eax, dword [esp + 0x344]
lea ecx, [esp + 8]
push eax
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test esi, esi
lea ecx, [esp + 0x150]
mov byte [esp + 0x338], 0
setne bl
call fcn.00423230
lea ecx, [esp + 8]
mov dword [esp + 0x338], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x330]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x334
ret

Function at 0x40e240
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x443266
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
push esi
lea ecx, [esp + 4]
call fcn.004094f0
mov eax, dword [esp + 0x2a4]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x2a0], 0
call fcn.0040ac90
push 0x5c
push 0x2f
lea ecx, [esp + 0xc]
call fcn.0040b230
lea ecx, [esp + 4]
call fcn.00409640
test eax, eax
jle 0x40e2ef
lea ecx, [esp + 0x14c]
call fcn.004094f0
lea ecx, [esp + 0x14c]
lea edx, [esp + 4]
push ecx
push edx
mov byte [esp + 0x2a4], 1
call fcn.0040c3f0
add esp, 8
lea ecx, [esp + 0x14c]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp + 0x14c]
mov esi, eax
mov byte [esp + 0x29c], 0
call fcn.00409580
jmp 0x40e301
lea ecx, [esp + 4]
call fcn.00409970
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test esi, esi
pop esi
jne 0x40e341
mov ecx, dword [esp + 0x2a4]
test ecx, ecx
je 0x40e316
call fcn.0041d0e0
lea ecx, [esp]
mov dword [esp + 0x298], 0xffffffff
call fcn.00409580
xor al, al
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
add esp, 0x29c
ret
lea ecx, [esp]
mov dword [esp + 0x298], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x290]
mov al, 1
mov dword fs:[0], ecx
add esp, 0x29c
ret

Function at 0x40ed10
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret
Function at 0x40ed30
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x410680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4434a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x2c]
push esi
push edi
push str.ensureFile
push ebx
lea ecx, [esp + 0x14]
call fcn.0041d220
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], 0
test eax, eax
jne 0x4106ef
mov eax, dword [ebx]
push str.No_filePath
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d2b0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov esi, dword [esp + 0x2c]
push eax
mov ecx, esi
call fcn.004064e0
push 0x5c
push 0x2f
mov ecx, esi
call fcn.00404750
mov ecx, esi
call fcn.004045f0
mov ecx, esi
call fcn.004044e0
mov edi, eax
push 0x5c
push edi
call fcn.00438ca0
add esp, 8
test eax, eax
je 0x410784
sub eax, edi
mov edi, eax
je 0x410784
mov ecx, esi
call fcn.004044f0
sub eax, edi
mov ecx, esi
push eax
call fcn.004067f0
mov ecx, esi
call fcn.004044f0
test eax, eax
je 0x410784
mov ecx, dword [esp + 0x30]
push ebx
push ecx
mov ecx, esi
call fcn.004044e0
push eax
call fcn.004107b0
add esp, 0xc
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d2b0
pop edi
mov al, bl
pop esi
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041d2b0
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x410d80
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10c
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
test ebp, ebp
push edi
je 0x410f38
mov ebx, dword [esp + 0x120]
test ebx, ebx
je 0x410f38
push ebp
push ebp
call fcn.00410d30
mov edi, dword [esp + 0x134]
add esp, 8
mov ecx, edi
push eax
call fcn.00405070
mov eax, 0xaaaaaaab
xor esi, esi
mul ebp
mov ebp, dword [esp + 0x128]
xor ecx, ecx
shr edx, 1
je 0x410e96
mov dword [esp + 0x10], edx
jmp 0x410de8
mov ebx, dword [esp + 0x120]
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
inc esi
mov edi, edx
inc esi
xor edx, edx
mov dl, byte [esi + ebx]
mov ebx, eax
sar ebx, 2
and ebx, 0x3f
and eax, 3
shl eax, 4
mov bl, byte [ebx + ebp]
inc esi
mov byte [esp + ecx + 0x14], bl
mov ebx, edi
sar ebx, 4
and ebx, 0xf
inc ecx
or ebx, eax
and edi, 0xf
shl edi, 2
mov al, byte [ebx + ebp]
mov byte [esp + ecx + 0x14], al
mov eax, edx
sar eax, 6
and eax, 3
inc ecx
or eax, edi
and edx, 0x3f
inc ecx
mov al, byte [eax + ebp]
mov byte [esp + ecx + 0x13], al
mov dl, byte [edx + ebp]
mov byte [esp + ecx + 0x14], dl
inc ecx
cmp ecx, 0x100
jl 0x410e68
mov edi, dword [esp + 0x12c]
lea eax, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00405510
xor ecx, ecx
jmp 0x410e6f
mov edi, dword [esp + 0x12c]
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x410de1
test ecx, ecx
je 0x410e8f
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.00405510
mov ebx, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
xor edx, edx
mov ecx, 3
div ecx
dec edx
je 0x410efb
dec edx
jne 0x410f38
xor eax, eax
xor edx, edx
mov al, byte [esi + ebx]
mov dl, byte [esi + ebx + 1]
mov dword [esp + 0x10], eax
mov ecx, edi
sar eax, 2
and eax, 0x3f
mov esi, edx
mov al, byte [eax + ebp]
push eax
call fcn.00404a40
mov eax, dword [esp + 0x10]
mov ecx, esi
sar ecx, 4
and eax, 3
and ecx, 0xf
shl eax, 4
or ecx, eax
mov dl, byte [ecx + ebp]
mov ecx, edi
push edx
call fcn.00404a40
and esi, 0xf
mov al, byte [ebp + esi*4]
push eax
jmp 0x410f28
xor ecx, ecx
mov cl, byte [esi + ebx]
mov esi, ecx
mov ecx, edi
mov edx, esi
sar edx, 2
and edx, 0x3f
mov al, byte [edx + ebp]
push eax
call fcn.00404a40
and esi, 3
shl esi, 4
mov cl, byte [esi + ebp]
push ecx
mov ecx, edi
call fcn.00404a40
push 0x3d
mov ecx, edi
call fcn.00404a40
push 0x3d
mov ecx, edi
call fcn.00404a40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x41c410
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44381b
push eax
mov dword fs:[0], esp
sub esp, 0x14c
push esi
mov esi, dword [esp + 0x160]
mov ecx, esi
call fcn.00404910
mov al, byte [0x46388d]
test al, al
jne 0x41c49a
push edi
mov ecx, 0x80
xor eax, eax
mov edi, 0x4634d4
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x100
push eax
push 0x4634d4
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
pop edi
jne 0x41c493
mov ecx, dword [str.Win32]
mov edx, dword [0x451a54]
mov ax, word [0x451a58]
mov dword [0x4634d4], ecx
mov dword [0x4634d8], edx
mov word [0x4634dc], ax
mov byte [0x46388d], 1
lea ecx, [esp + 8]
call fcn.004094f0
push 0x4634d4
lea ecx, [esp + 0xc]
mov dword [esp + 0x15c], 0
call fcn.0040a560
lea ecx, [esp + 8]
call fcn.0040a920
push eax
mov ecx, esi
call fcn.00405300
lea ecx, [esp + 8]
mov dword [esp + 0x158], 0xffffffff
call fcn.00409580
mov ecx, dword [esp + 0x150]
pop esi
mov dword fs:[0], ecx
add esp, 0x158
ret

Function at 0x41cbc0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov byte [ebp], 0
test esi, esi
mov ebx, ecx
mov dword [edi], 0
je 0x41ccaa
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x41ccaa
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x41cc4d
push 0
push edi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41cc3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x41cc20
pop edi
mov byte [ebp], 1
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x41ccbc
push eax
call fcn.0041d180
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
cmp dword [edi], 0
jne 0x41cc44
mov byte [ebp], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x41cc8f
push eax
push esi
push 1
push ecx
call fcn.0043964f
add esp, 0x10
cmp eax, esi
mov dword [edi], eax
jne 0x41cc70
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0x14
mov eax, dword [ebx + 8]
test byte [eax + 0xc], 0x20
je 0x41cc13
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x41ccbc
call fcn.0041d0e0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x41ccbc
mov edx, dword [ecx]
push str.No_file_is_open.
call dword [edx + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x41ccbc
mov eax, dword [ecx]
push str.NULL_buf_or_bufSize
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x14
Function at 0x41ccd0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], ecx
call fcn.0041c610
test al, al
jne 0x41cd02
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x41ccf6
mov eax, dword [ecx]
push str.Failed_to_write_because_file_is_not_open.
call dword [eax + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x1c]
test edi, edi
je 0x41cd1b
mov dword [edi], 0
mov dword [edi + 4], 0
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, ebp
or ecx, eax
je 0x41cdd0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
test eax, eax
jl 0x41cd4a
jg 0x41cd43
cmp ebp, 0x989680
jbe 0x41cd4a
mov esi, 0x989680
jmp 0x41cd4c
mov esi, ebp
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x41cd7e
lea edx, [esp + 0x10]
push 0
push edx
push esi
push ebx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41cddc
mov edx, dword [esp + 0x10]
cmp edx, esi
jne 0x41cddc
jmp 0x41cd9d
mov eax, dword [ecx + 8]
test eax, eax
je 0x41cd9d
push eax
push 1
push esi
push ebx
call fcn.00439737
add esp, 0x10
cmp eax, 1
jne 0x41ce0c
mov edx, esi
mov dword [esp + 0x10], edx
add ebx, esi
sub ebp, esi
mov esi, dword [esp + 0x24]
mov eax, 0
sbb esi, eax
cmp edi, eax
mov dword [esp + 0x24], esi
je 0x41cdc2
mov esi, dword [edi]
add esi, edx
mov dword [edi], esi
mov ecx, dword [edi + 4]
adc ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x24]
mov eax, ebp
or eax, ecx
jne 0x41cd31
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0x14
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x41ce00
mov edx, dword [esi]
push 1
push str.WriteFileError
mov ecx, esi
call dword [edx + 0x24]
mov ecx, esi
call fcn.0041d0e0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x41ce1e
mov edx, dword [ecx]
push str.fwrite_failed.
call dword [edx + 0x14]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0x14
Function at 0x41ce30
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44385b
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 4]
sub esp, 0x84
cmp eax, 0xffffffff
push edi
je 0x41cede
lea ecx, [esp + 4]
xor edi, edi
push ecx
push eax
mov dword [esp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x41cece
push esi
mov esi, dword [esp + 0x9c]
cmp esi, edi
je 0x41cec5
lea ecx, [esp + 0xc]
call fcn.004058d0
lea ecx, [esp + 0xc]
mov dword [esp + 0x94], edi
call fcn.00406930
mov edi, dword [esi]
lea ecx, [esp + 0xc]
call fcn.004044e0
push eax
mov ecx, esi
call dword [edi + 0x14]
mov edx, dword [esi]
push str.Failed_to_get_file_size__64_
mov ecx, esi
call dword [edx + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x94], 0xffffffff
call fcn.00405990
or eax, 0xffffffff
or edx, 0xffffffff
pop esi
jmp 0x41cefc
mov ecx, dword [esp + 4]
push ecx
push eax
call fcn.00410b50
add esp, 8
jmp 0x41cefc
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x41cef6
push ecx
call fcn.0041c600
push eax
call fcn.00439841
add esp, 8
jmp 0x41cefc
or eax, 0xffffffff
or edx, 0xffffffff
mov ecx, dword [esp + 0x88]
pop edi
mov dword fs:[0], ecx
add esp, 0x90
ret 4

Function at 0x41d2f0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret
Function at 0x41ffa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x14], edx
jle 0x4200ab
push ebx
push edi
lea eax, [esi + 0x2a]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x454478]
mov ecx, dword [ecx*4 + 0x454c78]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x454878]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454078]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x454878]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x454c78]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454478]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454078]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x454878]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x454c78]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454478]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454078]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x454878]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x454c78]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454478]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x454078]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x14]
cmp edx, ecx
jl 0x41ffb6
pop edi
pop ebx
pop esi
ret
Function at 0x430b30
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ecx
mov al, byte [0x4647a8]
test al, al
jne 0x430c37
mov al, byte [0x4647a9]
test al, al
jne 0x430c2d
mov eax, dword [0x4647ac]
test eax, eax
jne 0x430c37
push ebp
push esi
push edi
push 0x400
mov byte [0x4647a9], 1
call fcn.00437f9c
add esp, 4
mov dword [esp + 0xc], eax
xor ebp, ebp
mov esi, eax
mov eax, ebp
xor edx, edx
mov ecx, 7
test al, 1
je 0x430b8d
mov edi, 1
shl edi, cl
or edx, edi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x430b80
shl edx, 0x18
mov dword [esi], edx
mov edi, 8
mov edx, dword [esi]
mov ecx, edx
and ecx, 0x80000000
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
dec edi
mov dword [esi], ecx
jne 0x430b9f
mov edx, ecx
xor eax, eax
mov ecx, 0x1f
test dl, 1
je 0x430bd4
mov edi, 1
shl edi, cl
or eax, edi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x430bc6
mov dword [esi], eax
inc ebp
add esi, 4
cmp ebp, 0xff
jbe 0x430b77
mov eax, dword [0x4647ac]
pop edi
pop esi
pop ebp
test eax, eax
jne 0x430c10
mov ecx, dword [esp]
mov byte [0x4647a8], 1
mov dword [0x4647ac], ecx
mov byte [0x4647a9], 0
pop ecx
ret
mov edx, dword [esp]
push edx
call fcn.00437ed6
add esp, 4
mov byte [0x4647a8], 1
mov byte [0x4647a9], 0
pop ecx
ret
push 1
call fcn.0041c390
add esp, 4
pop ecx
ret
Function at 0x430ee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x400
push esi
mov esi, dword [esp + 0x40c]
test esi, esi
jne 0x430efc
xor eax, eax
pop esi
add esp, 0x400
ret
push ebx
push ebp
push edi
call fcn.00430b30
mov ebp, dword [esp + 0x41c]
or edx, 0xffffffff
test ebp, ebp
jne 0x430f48
mov edi, dword [0x4647ac]
mov eax, dword [esp + 0x414]
mov ecx, edx
xor ebx, ebx
mov bl, byte [eax]
and ecx, 0xff
xor ecx, ebx
shr edx, 8
mov ecx, dword [edi + ecx*4]
xor edx, ecx
inc eax
dec esi
jne 0x430f1f
pop edi
mov eax, edx
pop ebp
pop ebx
not eax
pop esi
add esp, 0x400
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov edi, dword [0x4647ac]
mov ecx, dword [esp + 0x414]
xor eax, eax
mov al, byte [ecx]
mov ebx, dword [esp + eax*4 + 0x10]
inc ebx
mov dword [esp + eax*4 + 0x10], ebx
mov ebx, edx
and ebx, 0xff
xor ebx, eax
shr edx, 8
mov eax, dword [edi + ebx*4]
xor edx, eax
inc ecx
dec esi
jne 0x430f62
xor edi, edi
xor eax, eax
lea ecx, [esp + 0x10]
mov esi, 7
mov ebx, dword [ecx]
add ecx, 4
add eax, ebx
dec esi
jne 0x430f92
lea ecx, [esp + 0x2c]
mov esi, 0x79
mov ebx, 0x80
add edi, dword [ecx]
add ecx, 4
dec esi
jne 0x430faa
cmp ebx, 0x100
jge 0x430fcf
mov esi, 0x100
lea ecx, [esp + ebx*4 + 0x10]
sub esi, ebx
mov ebx, dword [ecx]
add ecx, 4
add eax, ebx
dec esi
jne 0x430fc5
shr edi, 2
cmp edi, eax
pop edi
sbb ecx, ecx
mov eax, edx
neg ecx
mov word [ebp], cx
pop ebp
pop ebx
pop esi
not eax
add esp, 0x400
ret

Function at 0x433aa0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
jge 0x433ab3
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x433ac2
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
xor bl, bl
call fcn.0041c570
mov esi, eax
test esi, esi
jne 0x433ad6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push edi
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x433ae5
mov bl, 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret

Function at 0x43b5ec
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499b0
push 0x43c16c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [0x465158]
test eax, eax
je 0x43b634
mov dword [ebp - 4], 1
call eax
jmp 0x43b630
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x43b63d
jmp 0x43f9f2
push 0xa
call fcn.0043c27d
push 0x16
call fcn.00441407
pop ecx
pop ecx
push 3
call fcn.00438472

Function at 0x43b642
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4499c8
push 0x43c16c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
mov eax, dword [fcn.0043b5ec]
test eax, eax
je 0x43b68a
mov dword [ebp - 4], 1
call eax
jmp 0x43b686
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call 0x43b693
jmp fcn.0043b5ec