joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4227c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50e243
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fld dword [0x555f88]
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0x11
mov dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 0xa
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
fstp dword [esi + 0xc]
fld dword [0x555f84]
mov ecx, esi
fstp dword [esi + 0x10]
fld dword [0x555f80]
fstp dword [esi + 0x14]
call fcn.00415cf0
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x424330
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x478
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x474], eax
mov eax, dword [esp + 0x47c]
push esi
push edi
push 0x54b718
push eax
lea eax, [esp + 0x14]
push eax
mov edi, ecx
mov dword [esp + 0x18], 0
call fcn.004f138d
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
jne 0x42438b
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x474]
xor ecx, esp
call fcn.004ecddb
add esp, 0x478
ret
push eax
push 0x400
lea ecx, [esp + 0x80]
push 1
push ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.004f1680
add esp, 0x10
test eax, eax
je 0x424405
lea edx, [esp + 0x78]
push edx
lea esi, [esp + 0x14]
call fcn.004278d0
mov eax, dword [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x84]
push 1
push ecx
call fcn.004f1680
add esp, 0x14
test eax, eax
jne 0x4243d7
lea eax, [esp + 0x10]
call fcn.004279e0
mov edx, dword [esp + 0xc]
push edx
call fcn.004f1714
mov ecx, dword [esp + 0x480]
add esp, 4
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004ecddb
add esp, 0x478
ret

Function at 0x424460
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
jmp fcn.00428c70

Function at 0x424560
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 4]
push ebx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00424610
mov byte [esp + 0xb], al
mov eax, dword [esp + 0x70]
add esp, 4
lea ebx, [esp + 8]
call fcn.004284c0
mov al, byte [esp + 7]
pop ebx
add esp, 0x64
ret

Function at 0x4245c0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret
Function at 0x425360
Capabilities:
Set file attributes

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov esi, eax
mov eax, dword [edi + 0x130]
mov edx, dword [eax + 0x18]
lea ebx, [edi + 0x130]
push esi
push ebp
mov ecx, ebx
call edx
test al, al
jne 0x4253af
mov ecx, ebp
call fcn.00416430
push 0x54abe4
push 0x549858
mov edx, eax
call fcn.00417ed0
add esp, 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
push ebx
push ebp
lea ecx, [edi + 0x344]
call fcn.00424e90
test al, al
je 0x425388
mov ebx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ebp
mov dword [edi + 8], ebx
call fcn.00425180
add esp, 0xc
test al, al
jne 0x42543b
cmp byte [esi + 0x11c], al
je 0x4253ff
add esi, 0xc
jmp 0x425402
mov esi, dword [esi + 8]
mov ecx, ebp
call fcn.00416430
mov edi, eax
push 0x54b948
push 0x549858
mov edx, edi
call fcn.00417ed0
add esi, 4
push esi
push 0x549858
mov edx, edi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push eax
push ecx
mov ecx, esi
call fcn.00417d60
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
mov ebx, 1
cmp eax, 0xffffffff
jne 0x4254de
mov edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x425492
cmp ebx, 3
jge 0x42552c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4254b3
cmp eax, 5
jne 0x4254f3
cmp ebx, 3
jge 0x42552c
push 0x80
mov ecx, esi
call fcn.00417d60
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0x80
push ebp
push 0
push edx
push eax
mov ecx, esi
call fcn.00417d60
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc ebx
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x425470
push esi
lea ecx, [edi + 0xc]
call fcn.0041e350
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
test eax, eax
jne 0x42552c
cmp byte [esi + 0x11c], al
je 0x425504
add esi, 0xc
jmp 0x425507
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x20]
add esi, 4
push esi
push 0x54b958
call fcn.004014b0
mov ecx, eax
call fcn.00417d40
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x42553b
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
call fcn.00416430
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.004170f0
mov ecx, ebp
call fcn.00416430
add ebx, 4
push ebx
push 0x54b948
mov ecx, eax
call fcn.00417d40
mov ecx, eax
call fcn.00417d40
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
Function at 0x425620
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x425649
test ebx, ebx
je 0x42563f
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4256cf
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x42567a
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00416430
mov esi, eax
call fcn.004170f0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00416430
mov esi, eax
push 0x54b978
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x4256d9
mov dword [ebx], eax
test eax, eax
jne 0x42563f
cmp byte [esi + 0x128], al
je 0x4256ee
add esi, 0x18
jmp 0x4256f1
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00416430
mov edi, eax
push 0x54b988
push 0x549858
mov edx, edi
call fcn.00417ed0
add esi, 4
push esi
push 0x549858
mov edx, edi
call fcn.00417ed0
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x425730
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4257cd
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x425778
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00416430
mov esi, eax
call fcn.004170f0
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00416430
mov esi, eax
push 0x54b9a8
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x4257d7
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x425900
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42596e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x42593f
cmp eax, 2
jne 0x42595a
mov eax, dword [esp]
test esi, esi
je 0x425968
test eax, eax
je 0x425963
test al, 1
jne 0x42595a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x425968
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x425b70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x50d778
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x14], ax
push 0x11
mov eax, str.SoftwareClasses_
lea esi, [esp + 0x14]
mov ebx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call fcn.004263d0
mov eax, edi
mov dword [esp + 0x38], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x425bd6
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea ecx, [esp + 0x14]
call fcn.004262f0
push 6
mov eax, str.Shell
lea ecx, [esp + 0x14]
call fcn.004262f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x28], esp
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], 0
push edx
lea eax, [esp + 0x34]
mov word [ecx + 4], dx
call fcn.00426240
push SysReAllocString
push ebx
call fcn.00425d60
add esp, 0x24
cmp dword [esp + 0x28], 8
mov bl, al
jb 0x425c4e
mov eax, dword [esp + 0x14]
push eax
call fcn.004ed1ab
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004ecddb
add esp, 0x30
ret
Function at 0x425fd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50e176
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x450]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x20], eax
xor ebx, ebx
xor ecx, ecx
push 0x3e
mov eax, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_
lea esi, [esp + 0x2c]
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], cx
call fcn.004263d0
mov eax, str.http
mov dword [esp + 0x458], ebx
lea edx, [eax + 2]
jmp 0x426050
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x426050
sub eax, edx
sar eax, 1
push eax
mov eax, str.http
lea ecx, [esp + 0x2c]
call fcn.004262f0
push 0xb
mov eax, str.UserChoice
lea ecx, [esp + 0x2c]
call fcn.004262f0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x458], 1
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x42609d
lea eax, [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
push eax
push SysReAllocString
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x426170
mov eax, dword [esp + 0x14]
push 0x3fe
lea edx, [esp + 0x4a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
mov word [esp + 0x50], cx
call fcn.004f2770
add esp, 0xc
push str.Progid
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], 0x200
call fcn.00425900
test eax, eax
jne 0x426161
xor ecx, ecx
cmp cx, word [esp + 0x44]
je 0x426161
mov edi, esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00425b70
test al, al
jne 0x426133
mov eax, edi
push eax
mov edi, esi
call fcn.00425c70
add esp, 4
mov byte [esp + 0x13], al
jmp 0x426138
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x426147
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x42615b
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004ed1ab
add esp, 4
mov al, byte [esp + 0x13]
jmp 0x426186
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x426170
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x40], 8
jb 0x426184
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ed1ab
add esp, 4
xor al, al
mov ecx, dword [esp + 0x450]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.004ecddb
mov esp, ebp
pop ebp
ret
Function at 0x426eb0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x50f44b
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x56957c]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56957c]
xor eax, esp
push eax
lea eax, [esp + 0x378]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38c]
mov ebp, dword [esp + 0x388]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
xor edi, edi
mov ebx, ecx
cmp eax, edi
je 0x426f1a
push eax
call fcn.004ed7b6
add esp, 4
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
lea esi, [esp + 0x1c]
call fcn.00425230
mov esi, vtable.t_fileRead.0
mov dword [esp + 0x1c], esi
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], edi
mov dword [esp + 0x370], edi
mov ecx, dword [esp + 0x14]
push ebx
push ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x388], edi
call fcn.00427790
test al, al
jne 0x426f89
mov dword [esp + 0x380], 0xffffffff
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.004252a0
xor al, al
jmp 0x4270f2
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x426fb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x426fb0
xor esi, esi
lea ecx, [esi + 4]
push ecx
call fcn.004ed893
mov edi, eax
add esp, 4
test edi, edi
jne 0x427019
cmp byte [ebx + 0x11c], al
je 0x426fcf
add ebx, 0xc
jmp 0x426fd2
mov ebx, dword [ebx + 8]
mov ecx, dword [esp + 0x14]
call fcn.00416430
push 0x54bb58
mov esi, eax
push 0x549858
mov edx, esi
call fcn.00417ed0
add ebx, 4
push ebx
push 0x549858
mov edx, esi
call fcn.00417ed0
mov dword [esp + 0x390], 0xffffffff
add esp, 0x10
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x426f6e
mov edx, dword [esp + 0x14]
push esi
push edi
push edx
lea ecx, [esp + 0x374]
call fcn.004277f0
test al, al
jne 0x42705e
cmp byte [ebx + 0x11c], al
je 0x42704b
mov ecx, dword [esp + 0x14]
add ebx, 0xc
call fcn.00416430
push 0x54b948
jmp 0x426fe0
mov ecx, dword [esp + 0x14]
mov ebx, dword [ebx + 8]
call fcn.00416430
push 0x54b948
jmp 0x426fe0
lea ecx, [esp + 0x1c]
call fcn.00425580
push 0x3a8
push esi
xor eax, eax
xor ecx, ecx
mov word [edi + esi + 2], ax
mov word [edi + esi], cx
mov esi, dword [esp + 0x1c]
push edi
push esi
push ebp
call fcn.00427280
test al, al
jne 0x4270c9
cmp byte [ebx + 0x11c], al
je 0x427097
add ebx, 0xc
jmp 0x42709a
mov ebx, dword [ebx + 8]
add ebx, 4
push ebx
push 0x54b948
mov ecx, esi
call fcn.004014b0
mov ecx, eax
call fcn.00417d40
mov dword [esp + 0x380], 0xffffffff
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x426f6e
mov dword [esp + 0x380], 0xffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], vtable.t_fileRead.0
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.004252a0
mov al, 1
mov ecx, dword [esp + 0x378]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x360]
xor ecx, esp
call fcn.004ecddb
add esp, 0x370
ret 8
Function at 0x427790
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push edi
push 0
push eax
mov eax, dword [esp + 0x14]
mov edi, ecx
call fcn.00425360
test al, al
jne 0x4277ab
pop edi
ret 8
mov edx, dword [edi + 4]
push esi
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4277d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4277d6
xor esi, esi
mov dword [edi + 0x350], esi
pop esi
mov al, 1
pop edi
ret 8
Function at 0x4291a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.00428c70
test eax, eax
jl 0x4293d8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x42920d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4291d0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x4293d4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x542bd8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x542bd8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5437d8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543fd8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x542bd8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5443d8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x542bd8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x543bd8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x542bd8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x542bd8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5437d8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543fd8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x542bd8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543bd8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x542bd8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5443d8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x542bd8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x542bd8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5437d8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543fd8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x542bd8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543bd8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x542bd8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5443d8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x542bd8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x542bd8]
and esi, 0xff
mov esi, dword [esi*4 + 0x5437d8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543fd8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x542bd8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x542bd8]
and edi, 0xff
xor esi, dword [edi*4 + 0x543bd8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x5443d8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x429221
pop edi
xor eax, eax
pop esi
ret
Function at 0x429f20
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x429fa5
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
lea ebx, [ebx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x429f40
pop ebx
test edi, edi
jle 0x42a005
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
inc ecx
shl al, 4
cmp edi, 1
jle 0x429fcd
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
cmp edi, 2
jge 0x429fef
mov eax, 0x3d
mov byte [ecx], al
inc ecx
mov byte [ecx], al
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
pop edi
mov byte [ecx], 0
pop esi
ret

Function at 0x42a180
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x42a192
mov esi, 0x571b8c
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00428220
add esp, 4
lea ebx, [esp + 8]
mov eax, esi
call fcn.004284c0
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret