joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c49d
Capabilities:
Access peb ldr_data

Disassembly:
lds esp, [esp + edx*2]
call fcn.0040a2fa
in al, 0x31
mov ch, 0x5d
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x40c4be
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0040a2fa
movsd dword es:[edi], dword [esi]
mov dl, 0xb1
jmp 0x47ccbd5a
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40673a
pop dword [ebp - 0x30]
mov eax, 0x40673a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xe6cd1a2c
add dword [ebp - 0x40], 0x67852b1f
mov dword [ebp - 0x3c], 0x6ec49d10
add dword [ebp - 0x3c], 0xc36eaf35
mov dword [ebp - 0x38], 0x226c937
add dword [ebp - 0x38], 0x4a257af7
mov dword [ebp - 0x34], 0xde96c75f
sub dword [ebp - 0x34], 0xde96c75f
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x97bd95af
add dword [ebp - 0x40], 0xdcb4d3a7
mov dword [ebp - 0x3c], 0xf77e9b2
add dword [ebp - 0x3c], 0x31f477c3
mov dword [ebp - 0x38], 0x6a4e300d
add dword [ebp - 0x38], 0xf9213c5f
mov dword [ebp - 0x34], 0x1c738d92
sub dword [ebp - 0x34], 0x1c738d92
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x320d51b
sub eax, 0x2e0541b
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x37141
push 0
call eax
mov ecx, 0x22563694
sub ecx, 0x2255f054
mov ebx, eax
mov esi, 0x3986cc80
sub esi, 0x393fe880
add esi, dword [ebp - 0x30]
mov edi, 0x165db8f2
sub dword [ebp - 0x10], ecx
mov edx, dword [esi]
sub dword [ebp - 0x1c], edi
sub edx, edi
xor dword [ebp - 8], ecx
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x40684c
add eax, 0x2e54b94f
add eax, 0xd1ac5284
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x3a287a35
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x3a28b1b0
call fcn.3a28a102
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
call dword [0x3a28e770]
xor ebx, ebx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x3a287af5
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x42c]
push eax
call fcn.3a28394a
add esp, 0xc
test eax, eax
jl 0x3a287af5
mov edi, dword [ebp - 0x42c]
cmp edi, 0x400
jg 0x3a287ad7
push edi
call fcn.3a282e50
test al, al
pop ecx
je 0x3a287ad7
mov eax, edi
call fcn.3a28a1e1
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x3a287ae3
push edi
lea ecx, [ebp - 0x428]
call fcn.3a28394a
push dword [ebp - 0x424]
push edi
push esi
push eax
call fcn.3a28394a
cmp eax, ebx
jne 0x3a287b2c
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287b0e
lea ecx, [ebp - 0x418]
call fcn.3a284831
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, 0x8007000e
lea esp, [ebp - 0x448]
call fcn.3a28a15b
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x424], edi
jne 0x3a287b4e
call fcn.3a283f4e
mov esi, eax
jmp 0x3a287c4c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x3a287b71
call fcn.3a283f4e
jmp 0x3a287c3e
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x41c], eax
je 0x3a287b67
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x420], esi
jae 0x3a287bca
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb3
lea ecx, [ebp - 0x418]
call fcn.3a284831
mov esi, 0x8007000e
lea ecx, [ebp - 0x428]
call fcn.3a282d72
mov eax, esi
jmp 0x3a287b1e
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.3a28394a
mov dword [ebp - 4], 1
jmp 0x3a287bfc
cmp dword [ebp - 0x418], ebx
jne 0x3a287c0b
mov esi, 0x8007000e
jmp 0x3a287c40
push esi
push dword [ebp - 0x41c]
push esi
push dword [ebp - 0x418]
call fcn.3a28394a
mov eax, dword [ebp - 0x418]
add esp, 0x10
push dword [ebp + 0x14]
mov byte [eax + esi], bl
push dword [ebp - 0x418]
lea ecx, [ebp - 0x434]
call fcn.3a28394a
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x3a287bb8
lea ecx, [ebp - 0x418]
call fcn.3a284831
jmp 0x3a287bb8
Function at 0x3a289a70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3a281bf8]
jne 0x3a28a781
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x3a28eb18], eax
mov dword [0x3a28eb14], ecx
mov dword [0x3a28eb10], edx
mov dword [0x3a28eb0c], ebx
mov dword [0x3a28eb08], esi
mov dword [0x3a28eb04], edi
mov word [0x3a28eb30], ss
mov word [0x3a28eb24], cs
mov word [0x3a28eb00], ds
mov word [0x3a28eafc], es
mov word [0x3a28eaf8], fs
mov word [0x3a28eaf4], gs
pushfd
pop dword [0x3a28eb28]
mov eax, dword [ebp]
mov dword [0x3a28eb1c], eax
mov eax, dword [ebp + 4]
mov dword [0x3a28eb20], eax
lea eax, [ebp + 8]
mov dword [0x3a28eb2c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x3a28ea68], 0x10001
mov eax, dword [0x3a28eb20]
mov dword [0x3a28ea1c], eax
mov dword [0x3a28ea10], 0xc0000409
mov dword [0x3a28ea14], 1
mov eax, dword [0x3a281bf8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x3a28e774]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x3a28ea60], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3a281f78
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x3a28ea60], 0
jne 0x3a28a871
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401443
pop dword [ebp - 0x10]
mov eax, 0xdd5f5063
add eax, 0x22e0c3e0
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8909b0b7
add dword [ebp - 0x20], 0xc5489494
mov dword [ebp - 0x1c], 0x57f70046
sub dword [ebp - 0x1c], 0x25c3b401
mov dword [ebp - 0x18], 0xe51d2b9a
add dword [ebp - 0x18], 0x672f1894
mov dword [ebp - 0x14], 0x3b26b392
sub dword [ebp - 0x14], 0x3b26b392
lea eax, [ebp - 0x20]
push eax
mov eax, 0xe0219023
sub eax, 0xdfe10fab
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x392b4373
sub dword [ebp - 0x20], 0xc4b8da1d
mov dword [ebp - 0x1c], 0xb51280e6
sub dword [ebp - 0x1c], 0x73a61f71
mov dword [ebp - 0x18], 0x5dafc59b
add dword [ebp - 0x18], 0x5bfa6d1
mov dword [ebp - 0x14], 0x43319cd9
add dword [ebp - 0x14], 0xbcce6327
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3aead
push 0
call eax
mov ecx, 0x4d8654a7
sub ecx, 0x4d86027d
mov edx, eax
mov ebx, 0x459200
add ebx, dword [ebp - 0x10]
mov esi, 0xb882f6df
add esi, 0x3570128f
mov edi, dword [ebx]
add dword [ebp - 4], 0x5eb6f98b
xor edi, esi
add dword [ebp - 0xc], 0x12cec7a5
mov dword [edx], edi
xor dword [ebp - 4], eax
add edx, 0xd2a93aa
sub edx, 0xd2a93a6
add ebx, 4
loop 0x40155a
add eax, 0xbe7efa1
add eax, 0xf4194bda
xor ebx, ebx
add ebx, eax
add eax, 0x6f33b4db
add eax, 0x90cc4b2a
mov ecx, 0x6932cce9
sub ecx, 0x68f2cce9
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x1005278e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1005279d
pop dword [ebp - 0x20]
mov eax, 0xe854641a
add eax, 0x27b0c383
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x6d93976c
add dword [ebp - 0x30], 0xe0beaddf
mov dword [ebp - 0x2c], 0x30da9eeb
sub dword [ebp - 0x2c], 0xfea752a6
mov dword [ebp - 0x28], 0x1c9af8e1
add dword [ebp - 0x28], 0x2fb14b4d
mov dword [ebp - 0x24], 0xfe2dfbf6
add dword [ebp - 0x24], 0x1d2040a
lea eax, [ebp - 0x30]
push eax
mov eax, 0x7d959cf5
sub eax, 0x6d900be9
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf44e84c7
sub dword [ebp - 0x30], 0x7fdc1b71
mov dword [ebp - 0x2c], 0xda6a36a9
add dword [ebp - 0x2c], 0x67022acc
mov dword [ebp - 0x28], 0x89e082df
add dword [ebp - 0x28], 0xd98ee98d
mov dword [ebp - 0x24], 0x60b0816
sub dword [ebp - 0x24], 0x60b0816
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xb8c88a16
sub eax, 0xa8c2f9d6
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x5f9cc
push 0
call eax
mov ecx, 0x9ce4c79d
sub ecx, 0x9ce47846
xor ebx, ebx
add ebx, eax
mov edx, 0xe3852161
add edx, 0x2c81729f
add edx, dword [ebp - 0x20]
mov edi, 0x6648d285
xor dword [ebp - 8], 0x9af7ab31
mov esi, dword [edx]
sub dword [ebp - 0x1c], eax
add esi, edi
sub dword [ebp - 8], ecx
mov dword [ebx], esi
xor dword [ebp - 0xc], edx
add ebx, 0x65bfe56d
sub ebx, 0x65bfe569
add edx, 4
loop 0x100528bb
add eax, 0x9b86c5f8
sub eax, 0x9b8595c9
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x77ca19f2
add ecx, 0x9835e60e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4012ae
Capabilities:
Hash data using rshash

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
mov edx, 0xf8c9
xor eax, eax
jmp 0x4012cc
imul eax, edx
imul edx, edx, 0x5c6b7
movsx ecx, cl
add eax, ecx
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x4012bd
cmp dword [ebp + 8], 0
pop esi
je 0x4012e0
xor edx, edx
div dword [ebp + 8]
mov eax, edx
pop ebp
ret

Function at 0x4016f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
push dword [ebp - 4]
mov esi, 0x48da98
push 0x46e0b4
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push esi
push esi
push SysReAllocStringLen
mov dword [ebp - 8], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
mov eax, esi
je 0x40174a
mov eax, 0x48daac
pop esi
leave
ret

Function at 0x401e50
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x18]
and dword [esi], 0
mov byte [eax], 0
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x401ec5
cmp word [ebx + 8], 2
jne 0x401ea5
cmp word [ebx + 0xa], 4
jne 0x401ea5
mov edi, dword [ebx + 0xc]
jmp 0x401e9f
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401de9
mov dword [esi], eax
test eax, eax
je 0x401ec0
lea esi, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x401e83
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.0043841a
add esp, 0x10
xor eax, eax
jmp 0x401eeb
push 8
pop eax
jmp 0x401eeb
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x401eeb
dec ecx
je 0x401ee6
dec ecx
je 0x401edf
dec ecx
jmp 0x401eeb
mov eax, 0x2afb
jmp 0x401eeb
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4024d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
cmp dword [0x48f190], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x40204f
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x40231e
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.00402013
jne 0x40262c
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x402622
lea eax, [ebp - 0x230]
push eax
mov esi, 0x10c
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00438139
push str.ws2_32
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00437828
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea eax, [ebp - 0x128]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x40258f
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40258b
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
jne 0x4025e4
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00438139
push str.wship6
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.00437828
add esp, 0x18
lea eax, [ebp - 0x128]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x402622
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4025e0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
je 0x402622
xor esi, esi
push dword [ebp + esi*8 - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + esi*8 - 0x14], eax
test eax, eax
je 0x402601
inc esi
cmp esi, 3
jl 0x4025e6
jmp 0x40260a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
je 0x402622
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x48b3c8], ecx
add eax, 8
cmp eax, 0x18
jl 0x402610
mov dword [0x48f190], 1
mov eax, dword [0x48b3c8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403230
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
ret
Function at 0x4034e8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x1c]
mov byte [ecx + eax + 0x20], 0x80
inc dword [eax + 0x1c]
cmp ecx, 0x37
mov ecx, dword [eax + 0x1c]
jle 0x403532
jmp 0x403508
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x40
jl 0x4034fd
call fcn.00403330
jmp 0x40351f
mov ecx, dword [eax + 0x1c]
mov byte [eax + ecx + 0x20], 0
inc dword [eax + 0x1c]
cmp dword [eax + 0x1c], 0x38
jl 0x403514
jmp 0x403537
mov byte [ecx + eax + 0x20], 0
inc dword [eax + 0x1c]
mov ecx, dword [eax + 0x1c]
cmp ecx, 0x38
jl 0x403527
mov ecx, dword [eax + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x58], dl
mov edx, ecx
shr ecx, 8
mov byte [eax + 0x5a], cl
mov cl, byte [eax + 0x18]
shr edx, 0x10
mov byte [eax + 0x5b], cl
mov ecx, dword [eax + 0x14]
mov byte [eax + 0x59], dl
mov edx, ecx
shr edx, 0x18
mov byte [eax + 0x5c], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 8
mov byte [eax + 0x5e], cl
mov cl, byte [eax + 0x14]
mov byte [eax + 0x5d], dl
mov byte [eax + 0x5f], cl
jmp fcn.00403330

Function at 0x4036c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
mov byte [ebp - 0x14], 0
push esi
push edi
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4036de
sub eax, ecx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.0040357a
add esp, 0xc
push 5
lea ecx, [ebp - 0x14]
pop edi
xor esi, esi
lea eax, [ecx + 3]
mov dl, byte [eax]
xor byte [ecx + esi], dl
mov dl, byte [ecx + esi]
xor byte [eax], dl
mov dl, byte [eax]
xor byte [ecx + esi], dl
inc esi
dec eax
cmp esi, 2
jl 0x403702
add ecx, 4
dec edi
jne 0x4036fd
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x10
push eax
mov eax, dword [ebp + 0xc]
call fcn.00403687
add esp, 0xc
pop edi
pop esi
leave
ret

Function at 0x403736
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x406300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
push esi
xor ebx, ebx
mov byte [ebp - 1], 1
call fcn.004399d2
add esp, 8
test eax, eax
jne 0x40634e
push 0x470e54
push esi
call fcn.00438800
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x406358
push esi
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.0043a00a
mov eax, dword [ebp + 0x10]
add esp, 8
test eax, eax
je 0x40634e
mov dword [eax], ebx
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x18], bl
je 0x4063aa
cmp byte [ebp + 0x14], bl
je 0x40636e
mov ecx, dword [ebp - 0x24]
inc ecx
push ecx
call fcn.00436a77
jmp 0x406378
mov edx, dword [ebp - 0x24]
inc edx
push edx
call fcn.004369bd
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ecx]
add esp, 4
test eax, eax
je 0x40634e
mov edx, dword [ebp - 0x24]
mov byte [eax + edx], bl
mov eax, dword [ecx]
test eax, eax
jne 0x4063e0
push esi
push str.Unable_to_allocate_memory_to_read__s_to_mem
call fcn.0043a00a
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x14], bl
je 0x4063ba
mov esi, dword [ebp - 0x24]
push esi
call fcn.00436a77
jmp 0x4063c6
mov edx, dword [ebp - 0x24]
push edx
call fcn.004369bd
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
mov dword [ecx], eax
mov eax, dword [edx]
add esp, 4
test eax, eax
jne 0x4063e3
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp - 0x24]
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4063ef
mov dword [eax], esi
test esi, esi
je 0x406458
sub esi, ebx
cmp esi, 0x8000
jbe 0x406402
mov esi, 0x8000
mov eax, dword [ebp - 8]
push eax
push esi
push 1
push edi
call fcn.00438a61
add esp, 0x10
cmp eax, esi
jne 0x406423
mov esi, dword [ebp - 0x24]
add ebx, eax
add edi, eax
cmp ebx, esi
jb 0x4063f3
jmp 0x406458
mov ecx, dword [ebp + 8]
push ecx
push ebx
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.0043a00a
mov esi, dword [ebp + 0xc]
mov edx, dword [esi]
push edx
call fcn.00436a3d
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [esi], 0
test eax, eax
je 0x406454
mov dword [eax], 0
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
push eax
call fcn.00438ef6
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14