joyce8/EMBER2024-capa huggingface dataset:
Function at 0x130ad240
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x130df3a8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x130ad272
call fcn.1309bd80
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x130ad283
mov ecx, 0x80000000
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x130ad2d8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x130ad2be
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x130ad404
cmp dword [esp + 0x18], ebx
jne 0x130ad2d8
cmp dword [esp + 0x14], ebx
je 0x130ad404
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x130ad2e9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.1305d470
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x130ad32f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x130ad32f
call fcn.130729d0
test eax, eax
je 0x130ad32f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.1305e100
push ebx
lea ecx, [esp + 0x14]
call fcn.1305eb10
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x130ad3de
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x130ad36b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x130ad3de
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x130ad3b9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x130ad3bc
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x130ad3b4
mov dword [esi + 0x10], ebx
jmp 0x130ad3bc
mov dword [esi + 0x10], ecx
jmp 0x130ad3bc
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.1305dea0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.1305dea0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x130ad25a
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x130df3a8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x130ad272
call fcn.1309bd80
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x130ad283
mov ecx, 0x80000000
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x130ad2d8
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x130ad2be
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x130ad404
cmp dword [esp + 0x18], ebx
jne 0x130ad2d8
cmp dword [esp + 0x14], ebx
je 0x130ad404
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x130ad2e9
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.1305d470
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x130ad32f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x130ad32f
call fcn.130729d0
test eax, eax
je 0x130ad32f
push str.Global_
lea ecx, [esp + 0x14]
call fcn.1305e100
push ebx
lea ecx, [esp + 0x14]
call fcn.1305eb10
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 8], eax
je 0x130ad3de
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x130ad36b
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x130ad3de
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x130ad3b9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x130ad3bc
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x130ad3b4
mov dword [esi + 0x10], ebx
jmp 0x130ad3bc
mov dword [esi + 0x10], ecx
jmp 0x130ad3bc
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.1305dea0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.1305dea0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x130b0734
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.130839b0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x130b06fb
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x130b070d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x130b0879
push esi
call fcn.130b4250
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x130b0743
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.130b1770
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x130b0782
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.130af750
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.130af8c0
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.130af9c0
add esp, 0x24
jmp 0x130b07c1
test ebp, ebp
jl 0x130b078e
cmp ebp, 0x80
jle 0x130b07a2
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.130b1770
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x130b07e6
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x130b07ef
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.130af750
push esi
call fcn.130b4250
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.130af8c0
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x130b082b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.130af750
push esi
call fcn.130b4250
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.130af8c0
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.130afa70
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x130b085e
jmp 0x130b07ed
Function at 0x130b15f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.130839b0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x130b1639
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x130b1639
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x130f53a8
call fcn.130dba56
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.130adc17
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x130b174b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x130b174b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x130b174b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x130b174b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x130b174b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.130839b0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x130b174b
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.1308247c
add esp, 8
test eax, eax
je 0x130b174b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x130b2a60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.130839b0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x130b2bb4
cmp ebx, 0x80
jg 0x130b2bb4
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.130b3370
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x130b2af7
test ebp, ebp
jle 0x130b2b45
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x130b2ae4
jmp 0x130b2b41
xor esi, esi
test ebp, ebp
jle 0x130b2b45
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x130b2b27
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x130b2b23
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x130b2b54
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x130b2b85
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x130b2b9c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x130b2b98
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x130b7b20
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x130b9430
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x130b9490
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret
Function at 0x130babd0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
mov eax, 1
ret

Function at 0x130bac70
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x40], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x44], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret
Function at 0x130beab0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x130c48d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x130c4931
mov al, byte [edi]
test al, al
je 0x130c4931
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x130c48e9
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40ceee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x40cefc
and dword [esi], 0
xor eax, eax
inc eax
cmp dword [ebp + 0x10], 0
jbe 0x40cf34
mov eax, 0x8000
cmp dword [ebp + 0x10], eax
jae 0x40cf12
mov eax, dword [ebp + 0x10]
push 0
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x40cf34
mov ecx, dword [ebp + 0x10]
add dword [esi], ecx
test eax, eax
setne al
movzx eax, al
push eax
call fcn.0040cc53
pop esi
pop ebp
ret 0x10

Function at 0x40eee8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x43c99c], 0
jne 0x40ef24
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00410f66
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041116b
pop ecx
test esi, esi
pop esi
je 0x40ef34
mov al, 1
jmp 0x40ef36
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x40ef1e
xor al, al
leave
ret 8

Function at 0x40ef3a
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x43c99c], 0
jne 0x40ef72
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00410f66
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041116b
pop ecx
test esi, esi
pop esi
je 0x40ef7f
mov al, 1
jmp 0x40ef81
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x40ef6c
xor al, al
leave
ret 4

Function at 0x40eff7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x43c99c], 0
jne 0x40f032
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00410f66
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.0041116b
pop ecx
test esi, esi
pop esi
je 0x40f041
mov al, 1
jmp 0x40f043
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x40f02c
xor al, al
leave
ret 4

Function at 0x40f8ce
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40f8f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40f8f4
xor al, al
jmp 0x40f909
mov edx, dword [ebp - 4]
xor eax, eax
xor ecx, ecx
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x41638b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea edi, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], eax
test eax, eax
je 0x4163c0
mov ebx, dword [edx]
mov dword [ecx + esi*4 + 0x10], ebx
inc esi
add edx, 4
cmp esi, eax
jb 0x4163b2
cmp esi, edi
jae 0x4164a1
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4 + 0x10]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 + 0xc]
mov dword [ebp - 8], eax
test edx, edx
jne 0x416438
mov eax, edi
mov ebx, edi
mov edx, 0xff
and eax, edx
movzx eax, byte [eax + str.cw]
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, edi
shr edi, 8
and edi, edx
shr ebx, 0x10
and ebx, edx
movzx edx, byte [edi + str.cw]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [ebp - 8]
movzx edi, byte [edi + 0x432450]
shl eax, 8
or eax, ebx
shl eax, 8
xor edi, edx
or edi, eax
jmp 0x416488
cmp dword [ebp + 8], 6
jbe 0x416488
cmp edx, 4
jne 0x416488
mov edx, edi
shr edx, 0x10
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
mov eax, 0xff
and edx, eax
movzx edx, byte [edx + str.cw]
shl ebx, 8
or edx, ebx
mov ebx, edi
shr ebx, 8
and ebx, eax
movzx ebx, byte [ebx + str.cw]
shl edx, 8
and edi, eax
movzx edi, byte [edi + str.cw]
or edx, ebx
shl edx, 8
or edi, edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add dword [ebp - 4], 4
xor eax, edi
mov dword [ecx + esi*4 + 0x10], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4163d3
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x417443
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jb 0x41759e
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], ecx
lea edi, [eax + esi]
jmp 0x417481
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x417486
inc edi
cmp edi, dword [ebp - 4]
jb 0x417478
mov eax, edi
sub eax, esi
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 4]
jae 0x41757e
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x4174dd
xor edx, edx
mov cl, byte [edi + 4]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x4174b1
cmp cl, 0xff
jne 0x417508
movzx esi, cl
movzx ecx, byte [edi + 3]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 2]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 1]
shl esi, 8
or esi, ecx
cmp dword [ebp + 0x18], 0
je 0x417516
lea ebx, [esi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x41751d
dec ecx
shl edx, cl
and edx, 7
je 0x4174a2
movzx ecx, byte [edx + 0x428098]
mov ebx, edi
sub ebx, ecx
cmp byte [edx + 0x428090], 0
mov cl, byte [ebx + 4]
je 0x417505
test cl, cl
je 0x417505
cmp cl, 0xff
jne 0x4174a2
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x417473
sub esi, eax
sub esi, dword [ebp + 0x10]
mov ebx, esi
test edx, edx
je 0x417551
movzx esi, byte [edx + 0x428098]
push 0x18
shl esi, 3
pop ecx
sub ecx, esi
mov eax, ebx
shr eax, cl
test al, al
je 0x41753c
cmp al, 0xff
jne 0x41754e
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, esi
xor esi, esi
inc esi
shl esi, cl
dec esi
xor esi, ebx
jmp 0x4174cf
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [edi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add eax, 5
jmp 0x417473
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret 0x14

Function at 0x41a511
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret 4

Function at 0x41a8a2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.0041f4b4
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.0041a854
pop ebp
ret 0xc