joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c860
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46dfd3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00461a50
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.004670e6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00468602
test eax, eax
je 0x43c97c
mov ecx, dword [esp + 0x3c]
call fcn.00467113
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43c940
push edi
mov ecx, esi
call fcn.0046477b
mov ecx, esi
call fcn.0043cae0
cmp dword [esp + 0x38], 1
jne 0x43c975
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004648b6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43f3a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43f3d3
push esi
call fcn.00442490
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43f3cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43f459
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43f442
mov eax, dword [esi + 8]
test eax, eax
je 0x43f3f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43f43e
cmp eax, 2
je 0x43f442
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43f3ea
cmp eax, 3
je 0x43f41d
cmp eax, 1
jne 0x43f3ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43f3ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43f3ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043f480
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43f468
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043f480
add esp, 4
pop esi
ret

Function at 0x44b4e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44b583
test eax, eax
jbe 0x44b583
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44b583
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44b52e
xor esi, esi
jmp 0x44b534
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44b55f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004042b0
add esi, eax
push esi
mov ebx, esi
call fcn.004042b0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44b540
pop ebp
test edi, edi
pop edi
jne 0x44b583
test ebx, ebx
je 0x44b583
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00451320
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44b6c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44b7dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44b7dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00461ea2
mov esi, eax
test esi, esi
je 0x44b7dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44b7dd
mov ecx, esi
call fcn.0044b630
cmp edi, eax
jge 0x44b7dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44b763
mov dword [esp + 0x34], 1
jmp 0x44b7be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44b7dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044abe0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x462846
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46287e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004608fa
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004608d2
jmp 0x46288a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x463f38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x463f7a
call fcn.004699ed
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x463f7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x463f71
xor eax, eax
jmp 0x463f82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00463f88
pop edi
pop esi
pop ebx
ret 4
Function at 0x469f1d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x469f4b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x469f69
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00469e83
jmp 0x469f69
mov eax, dword [esi + 0x14]
test eax, eax
je 0x469f69
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00469e83
test edi, edi
mov eax, edi
jne 0x469f53
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4044f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x404509
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40451d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40453e
cmp esi, eax
jae 0x404517
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404530
cmp esi, eax
jae 0x404517
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x409730
Capabilities:
Inspect load icon resource

Disassembly:
push 0xffffffffffffffff
push 0x484c8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
push eax
xor ebx, ebx
push 0x66
mov dword [esp + 0x20], ebx
call fcn.0047b77b
mov byte [esp + 0x18], 1
mov dword [esi], 0x48ada8
mov byte [esi + 0x80], bl
call fcn.0047b5d6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x84], eax
lea edi, [esi + 0x88]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.00406210
mov dword [edi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
mov edi, dword [esp + 0x20]
add edi, 0xfffffff0
push edi
mov byte [esp + 0x1c], 3
call fcn.00405fa0
add eax, 0x10
add esp, 4
mov dword [esi + 0x98], eax
push 0x48ad61
lea ecx, [esi + 0x9c]
mov byte [esp + 0x1c], 4
call fcn.00404bd0
lea ebx, [esi + 0xa0]
mov ecx, ebx
mov byte [esp + 0x18], 5
call fcn.00477f49
mov dword [ebx], 0x49bd8c
lea ebx, [esi + 0xf0]
mov ecx, ebx
mov byte [esp + 0x18], 6
call fcn.00477f49
mov dword [ebx], 0x49bd8c
lea ebx, [esi + 0x140]
mov ecx, ebx
mov byte [esp + 0x18], 7
call fcn.00477f49
mov dword [ebx], 0x49ba94
lea ebx, [esi + 0x190]
mov ecx, ebx
mov byte [esp + 0x18], 8
call fcn.00477f49
mov dword [ebx], 0x49bc44
lea ebx, [esi + 0x1e0]
mov ecx, ebx
mov byte [esp + 0x18], 9
call fcn.00477f49
mov dword [ebx], 0x49bd8c
mov byte [esp + 0x18], 0xa
call fcn.0048180c
call fcn.0048180c
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi + 0x94], eax
mov dword [esp + 0x18], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4098a2
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40ed30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4852a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov esi, ecx
push 0x24
xor ebx, ebx
push str.AlgorithmParametersBase:_parameter__
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.00401980
mov eax, dword [esp + 0x74]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x50]
push edx
mov dword [esp + 0x78], ebx
call fcn.0040e870
push str.__not_used
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x84], 1
call fcn.0040e870
add esp, 0x18
mov edi, eax
mov ecx, esi
mov byte [esp + 0x6c], 2
call fcn.0045cc6e
push edi
lea ecx, [esi + 0x10]
mov byte [esp + 0x70], 3
mov dword [esi], 0x492c6c
mov dword [esi + 0xc], 6
call fcn.00401ac0
mov eax, dword [esp + 0x44]
mov edi, 0x10
cmp eax, edi
jb 0x40ede9
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00477409
add esp, 4
cmp dword [esp + 0x60], edi
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
jb 0x40ee0c
mov edx, dword [esp + 0x4c]
push edx
call fcn.00477409
add esp, 4
cmp dword [esp + 0x28], edi
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
jb 0x40ee2f
mov eax, dword [esp + 0x14]
push eax
call fcn.00477409
add esp, 4
mov ecx, dword [esp + 0x64]
pop edi
mov dword [esi], 0x492cd4
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 4

Function at 0x411bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4852c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0x1f
push str.CryptoPP:_invalid_group_element
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.00401980
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.0045cc6e
lea eax, [esp + 8]
push eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x30], 1
mov dword [esi], 0x492c6c
mov dword [esi + 0xc], 4
call fcn.00401ac0
cmp dword [esp + 0x20], 0x10
mov dword [esi], 0x492cd4
jb 0x411c3c
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00477409
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword [esi], 0x492fa4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x4130a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push 0x12
xor ebx, ebx
push str.vector_T__too_long
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
call fcn.00401980
lea ecx, [esp + 0x20]
mov dword [esp + 0x50], ebx
call fcn.0045cc6e
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
mov dword [esp + 0x24], vtable.std::logic_error.0
call fcn.00401ac0
push 0x4a7514
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x58], bl
mov dword [esp + 0x28], vtable.std::length_error.0
call fcn.0045c382
pop ebx
int3
Function at 0x413e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485808
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.00436bee
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x30], 0
call fcn.0043401d
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shl edx, 2
mov ecx, edx
mov ebp, ecx
shr ecx, 2
mov esi, eax
mov ebx, edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
cmp edx, 0x10
rep stosb byte es:[edi], al
push ebx
jb 0x413ecf
call fcn.0045e483
jmp 0x413ed4
call fcn.0045c278
mov ecx, dword [esp + 0x28]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x41c7d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x485d6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
push edi
call fcn.0040bc60
mov esi, dword [ebp + 8]
mov cl, byte [esi]
mov dl, byte [esi + 1]
mov ebx, eax
mov al, 1
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], al
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0xb4], 0
mov byte [esp + 0x30], 0
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], dl
mov byte [esp + 0x12], al
call fcn.0041ea00
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x1c], eax
call fcn.00414f20
mov edx, dword [ebx]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call dword [edx + 0x14]
mov edx, dword [ebx]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 8]
push eax
mov ecx, ebx
call dword [edx + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x90]
mov ecx, eax
mov edx, ecx
shr ecx, 2
add esi, 0x10
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x11c
mov dword [esp + 0xb4], eax
call fcn.004773d9
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0xc4], eax
je 0x41c8cc
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0041bf40
mov dword [esi], 0x4941a0
mov dword [esi + 0x118], ebx
mov eax, esi
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421820
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x4219d0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x58
mov ecx, dword [esp + 0x5c]
xor eax, eax
push esi
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x64]
push eax
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00421850
mov esi, dword [esp + 0x74]
lea eax, [esp + 0x10]
push esi
push eax
call fcn.00421920
add esp, 0x14
mov eax, esi
pop esi
add esp, 0x58
ret
Function at 0x440873
Capabilities:
Hash data using sha256

Disassembly:
push 0x20
push 0x496d00
push dword [esp + 0xc]
call fcn.0045f240
add esp, 0xc
ret

Function at 0x4422b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 1
push edi
call fcn.0043c1f2
test al, al
pop ecx
pop ecx
je 0x44230e
push 1
push dword [ebp + 0xc]
call fcn.0043c1f2
test al, al
pop ecx
pop ecx
je 0x44230e
mov edx, dword [ebp + 0x10]
xor esi, esi
shr edx, 2
je 0x4422ff
mov ecx, dword [ebp + 0xc]
mov eax, edi
sub ecx, edi
mov esi, edx
push ebx
mov ebx, dword [ecx + eax]
xor dword [eax], ebx
add eax, 4
dec edx
jne 0x4422f3
pop ebx
mov eax, esi
shl eax, 2
sub dword [ebp + 0x10], eax
je 0x442325
add edi, eax
add dword [ebp + 0xc], eax
mov esi, dword [ebp + 0x10]
test esi, esi
jbe 0x442325
mov ecx, dword [ebp + 0xc]
mov eax, edi
sub ecx, edi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x44231c
pop edi
pop esi
pop ebp
ret
Function at 0x45d346
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0045d250
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x45d3e1
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4bcb5c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x45d3e1
cmp eax, 1
je 0x45d402
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x45d3e1
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x45d3ae
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x45d3dd
xor eax, eax
inc eax
jmp 0x45d421
cmp edi, eax
jae 0x45d3e5
xor eax, eax
jmp 0x45d421
cmp eax, esi
jae 0x45d3ec
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4bcb5c]
jmp 0x45d405
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45e211
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x49d6a8
call fcn.0045fc00
mov edi, 0x94
mov eax, edi
call fcn.0045d250
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4bcb5c], ecx
mov eax, dword [esi + 4]
mov dword [0x4bcb68], eax
mov edx, dword [esi + 8]
mov dword [0x4bcb6c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4bcb60], esi
cmp ecx, 2
je 0x45e271
or esi, 0x8000
mov dword [0x4bcb60], esi
shl eax, 8
add eax, edx
mov dword [0x4bcb64], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x45e2ac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45e2ac
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x45e2c4
cmp eax, 0x20b
je 0x45e2b1
mov dword [ebp - 0x1c], esi
jmp 0x45e2d8
cmp dword [ecx + 0x84], 0xe
jbe 0x45e2ac
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x45e2d2
cmp dword [ecx + 0x74], 0xe
jbe 0x45e2ac
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0046139d
pop ecx
test eax, eax
jne 0x45e2ec
push 0x1c
call fcn.0045e1ed
pop ecx
call fcn.00463354
test eax, eax
jne 0x45e2fd
push 0x10
call fcn.0045e1ed
pop ecx
call fcn.00466ef2
mov dword [ebp - 4], esi
call fcn.00463add
test eax, eax
jge 0x45e316
push 0x1b
call fcn.0045e1c8
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4bd5b0], eax
call fcn.00466dd0
mov dword [0x4bcb38], eax
call fcn.00466d2e
test eax, eax
jge 0x45e33c
push 8
call fcn.0045e1c8
pop ecx
call fcn.00466afb
test eax, eax
jge 0x45e34d
push 9
call fcn.0045e1c8
pop ecx
push 1
call fcn.0046008a
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x45e363
push eax
call fcn.0045e1c8
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00466a9e
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x45e384
movzx eax, word [ebp - 0x40]
jmp 0x45e387
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00475a3d
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x45e3a5
push edi
call fcn.004601b7
call fcn.004601d9
jmp 0x45e3d7
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0045fc3b
ret
Function at 0x4600f4
Capabilities:
Terminate process

Disassembly:
push 8
push 0x49d740
call fcn.0045fc00
push 8
call fcn.00461313
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4bcb9c], esi
jne 0x460128
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4bcb98], esi
mov al, byte [ebp + 0x10]
mov byte [0x4bcb94], al
cmp dword [ebp + 0xc], edi
jne 0x460172
cmp dword [0x4bd5a8], edi
je 0x460162
mov eax, dword [0x4bd5a4]
sub eax, 4
mov dword [0x4bd5a4], eax
cmp eax, dword [0x4bd5a8]
jb 0x460162
mov eax, dword [eax]
cmp eax, edi
je 0x460143
call eax
jmp 0x460143
push 0x4b20d0
mov eax, 0x4b20c8
call fcn.00460072
pop ecx
push 0x4b20dc
mov eax, 0x4b20d4
call fcn.00460072
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4601a3
cmp dword [ebp + 0x10], edi
jne 0x4601b1
mov dword [0x4bcb9c], esi
push dword [ebp + 8]
call fcn.00460030
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4601b0
push 8
call fcn.0046125e
pop ecx
ret
call fcn.0045fc3b
ret